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Some  Observations  on  Mental  Models 


Donald  A.  Norman 

University  of  California,  San  Diego 


One  function  of  this  chapter  is  to  belabor  the  obvious;  people's 
views  of  the  world,  of  themselves,  of  their  own  capabilities,  and  of  the 
tasks  that  they  are  asked  to  perform,  or  topics  they  are  asked  to  learn, 
depend  heavily  on  the  conceptualizations  that  they  bring  to  the  task. 
In  interacting  with  the  environment,  with  others,  and  with  the  artifacts 
of  technology,  people  form  internal,  mental  models  of  themselves  and  of 
the  things  with  which  they  are  interacting.  These  models  provide 
predictive  and  explanatory  power  for  understanding  the  interaction. 
These  statements  hardly  need  be  said,  for  they  are  consistent  with  all 
that  we  have  learned  about  cognitive  processes  and,  within  this  book, 
represent  the  major  underlying  conceptual  theme.  Nonetheless,  it  does 
not  hurt  to  repeat  them  and  amplify  them,  for  the  scope  of  the  implica¬ 
tions  of  this  view  is  larger  than  one  might  think. 

In  the  consideration  of  mental  models  we  need  really  consider  four 
different  things:  the  target  system  the  conceptual  model  of  that  target 
system,  the  user's  mental  model  of  the  target  system,  and  the 
scientist's  conceptualization  of  that  mental  model.  The  system  that  the 
person  is  learning  or  using  is,  by  definition,  the  target  system.  A 
conceptual  model  is  invented  to  provide  an  appropriate  representation  of 
the  target  system,  appropriate  in  the  sense  of  being  accurate,  con¬ 
sistent,  and  complete.  Conceptual  models  are  invented  by  teachers, 
designers,  scientists,  and  engineers. 


To  be  published  in  D.  Gentner  and  A.  Stevens  (Eds.),  Mental  Models. 
Hillsdale,  N.  J.*  Erlbaum,  1982. 

This  research  was  conducted  under  Contract  N00014-79-C-0323,  NR 
157-437  with  the  Personnel  and  Training  Research  Programs  of  the  Office 
of  Naval  Research,  and  was  sponsored  by  the  Office  of  Naval  Research  and 
the  Air  Porce  Office  of  Scientific  Research.  I  thank  Sondra  Buffett  for 
her  suggestions  for  the  manuscript. 
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Mental  models  are  naturally  evolving  models.  That  is,  through 
interaction  wltfina- target .system,  people  formulate  mental  models  of  that 
system.  These  models  need  nofTW' technically  accurate  (and  usually  are 
not),  but  they  must  be  functional.  A  person,  through- Interaction  with 
the  system,  will  continue  to  modify  the  mental  model  in  order~€o  get  the_ 
necessary  results.  Mental  models  will  be  constrained  by  such  things  as 
the  user's  technical  background,  previous  experiences  with  similar  sys¬ 
tems,  and  the  structure  of  the  hiaan  information  processing  system.  The 
Scientist's  conceptualization  of  a  mental  model  is,  obviously,  a  model 
of  a  model. 


Some  Observations  on  Mental  Models 

My  observations  on  a  variety  of  tasks,  with  a  wide  variety  of  peo¬ 
ple,  lead  me  to  a  few  general  observations  about  mental  models: 

1.  Mental  models  are  incomplete. 

2.  People's  abilities  to  "run"  their  models  are  severely  limited. 

3.  Mental  models  are  unstable:  people  forget  the  details  of  the 
system  they  are  using,  especially  when  those  details  (or  the 
whole  system)  have  not  been  used  for  some  period. 

4.  Mental  models  do  not  have  firm  boundaries:  similar  devices  and 
operations  get  confused  with  one  another. 

5.  Mental  models  are  "unscientific":  people  maintain  "supersti¬ 
tious"  behavior  patterns  even  when  they  know  they  are  unneeded 
because  they  cost  little  in  physical  effort  and  save  mental 
effort. 

6.  Mental  models  are  parsimonious:  often  people  do  extra  physical 
operations  r£%her  than  the  mental  planning  that  would  allow  them 
to  avoid  those  actions;  they  are  willing  to  trade-off  extra 
physical  action  for  reduced  mental  complexity.  This  is  espe¬ 
cially  true  where  the  extra  actions  allow  one  simplified  rule  to 
apply  to  a  variety  of  devices,  thus  minimizing  the  chances  for 
confusions. 


Let  me  now  expand  upon  these  remarks.  In  my  studies  of  human  error 
and  human-machine  interaction,  I  have  made  reasonably  extensive  observa¬ 
tion  of  people's  interactions  with  a  number  of  technological  devices. 
The  situations  that  I  have  studied  are  quite  diverse,  including  such 
tasks  as  the  use  of  calculators,  computers,  computer  text  editors,  digi¬ 
tal  watches  and  cameras,  video  cameras  and  recorders,  and  the  piloting 
of  aircraft.  Some  of  these  have  been  studied  extensively  (the  computer 
text  editor),  others  only  in  informal  observation.  I  oonolude  that  most 
people's  understanding  of  the  devices  they  interact  with  is  suprisingly 
meager,  imprecisely  specified,  and  full  of  inconsistencies,  gaps,  and 
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idiosyncratic  quirks.  The  models  that  people  bring  to  bear  on  a  task 
are  not  the  precise,  elegant  models  discussed  so  well  in  this  book. 
Rather,  they  contain  only  partial  descriptions  of  operations  and  huge 
areas  of  uncertainties.  Moreover,  people  often  feel  uncertain  of  their 
own  knowledge  —  even  when  it  is  in  fact  complete  and  correct  —  and 
their  mental  models  include  statements  about  the  degree  of  certainty 
they  feel  for  different  aspects  of  their  knowledge.  Thus,  a  person's 
mental  model  can  include  knowledge  or  beliefs  that  are  thought  to  be  of 
doubtful  validity.  Some  of  this  is  characterized  as  "superstitious"  — 
rules  that  "seem  to  work,"  even  if  they  make  no  sense.  These  doubts  and 
superstitions  govern  behavior  and  enforce  extra  caution  when  performing 
operations.  This  is  especially  apt  to  be  the  case  when  a  person  has 
experience  with  a  number  of  different  systems,  all  very  similar,  but 
each  with  some  slightly  different  set  of  operating  principles. 

Observations  of  Calculator  Usage 

Let  me  briefly  review  some  of  my  observations  on  people's  use  of 
calculating  machines.  I  observed  people  using  hand-held  versions  of 
four-function,  algebraic,  and  stack  calculators  while  they  were  solving 
a  series  of  arithmetic  problems.  They  were  asked  to  "think  aloud"  as 
they  did  the  problems  and  I  watched  and  recorded  their  words  and 
actions.  When  all  problems  were  complete,  I  questioned  them  about  the 
methods  they  had  used  and  about  their  understanding  of  the  calculator.  1 
Although  the  people  I  observed  were  all  reasonably  experienced  with  the 
machines  on  which  I  tested  them,  they  seemed  to  have  a  distrust  of  the 
calculator  or  in  their  understanding  of  the  details  of  calculator 
mechanics.  As  a  result,  they  would  take  extra  steps  or  decline  to  take 
advantage  of  some  calculator  features,  even  when  they  were  fully  aware 
of  their  existence.  Most  of  the  people  I  studied  had  experience  with 
several  different  calculators,  and  as  a  result  they  mixed  up  the 
features.  They  were  often  unsure  which  feature  applied  to  which  calcu¬ 
lator.  They  had  various  superstitions  about  the  operations  of  the  cal¬ 
culator.  And  finally,  their  estimation  of  the  amount  of  mental  work¬ 
load  required  by  various  strategies  often  determined  their  actions;  they 
would  perform  extra  operations  in  order  to  reduce  the  amount  of  mental 
effort.  Let  me  provide  some  examples. 


1.  The  inspiration  for  these  studies  came  from  Richard 
of  calculator  operation,  presented  at  the  conference 
book.  However,  his  work  did  not  include  any  studies 
tually  believed  of  the  calculators  or  how  they  used  t] 
vestigations.  1  made  up  problems  that  required  only 
operations  —  addition,  subtraction,  multiplication,  an; 
some  required  storage  registers,  writing  down  of  pa; 
planning  of  the  sequence  to  avoid  the  need  for  writii 


g's  analyses 
led  to  this 
what  people  ac- 
:  hence  my  in- 
iple  arithmetic 
ivision  —  but 
.1  results ,  or 
r  storage. 


Since  performing  these  studies  and  writing  the i 
of  the  closely  related  observations  and  analyses 
man  (1981). 


[per  I  have  learned 
by  Mayer  and  Bay- 
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One  of  the  subjects  I  studied  (on  a  four-function  calculator)  was 
quite  cautious.  Her  mental  model  seemed  to  contain  information  about 
her  own  limitations  and  the  classes  of  errors  that  she  could  make.  She 
commented:  "I  always  take  extra  steps.  I  never  take  short  cuts."  She  was 
always  careful  to  clear  the  calculator  before  starting  each  problem, 
hitting  the  clear  button  several  times.  She  wrote  down  partial  results 
even  where  they  could  have  been  stored  in  the  machine  memory.  In  a 
problem  involving  "constant  sums,"  she  would  not  use  the  calculator's 
memory  because: 

I  would  not  have  done  that  because  often  when  you  play  with 
the  memory  and  the  clear  button,  if  you  are  not  really  clear 
about  what  it  actually  clears  you  can  clear  out  the  memory  and 
it  —  it  —  I'm  too  cautious  for  that.  I  would  be  afraid  that 
I'd  mess  up  the  memory. 


All  the  people  I  observed  had  particular  beliefs  about  their 
machines  and  about  their  own  limitations,  and  as  a  result  had  developed 
behavior  patterns  that  made  them  feel  more  secure  in  their  actions,  even 
if  they  knew  that  what  they  were  doing  was  not  always  necessary.  A 
major  pattern  that  seemed  to  apply  to  all  my  calculator  studies  was  the 
need  for  clearing  the  registers  and  displays.  The  four- function  calcu¬ 
lator  did  need  to  be  cleared  before  starting  new  problems,  but  the  stack 
and  algebraic  calculators  did  not.  Yet,  these  people  always  cleared 
their  calculators,  regardless  of  the  type.  Moreover,  they  would  hit  the 
clear  button  several  times  saying  such  things  as  "you  never  know  — 
sometimes  it  doesn't  register,"  or,  explaining  that  "there  are  several 
registers  that  have  to  be  cleared  and  sometimes  the  second  and  third 
clears  do  these  other  registers."  (The  four- function  calculator  that  I 
studied  does  require  two  depressions  of  the  CLEAR  button  to  clear  all 
registers. ) 

In  an  interesting  complement  to  the  excessive  depressing  of  CLEAR 
to  ensure  that  everything  got  cleared,  during  a  problem  with  the  four- 
function  calculator  where  it  became  necessary  to  clear  the  display  dur¬ 
ing  the  solution  of  a  problem,  one  person  balked  at  doing  so,  uncertain 
whether  this  would  also  clear  the  registers.  All  the  people  I  observed 
expressed  doubts  about  exactly  what  did  and  did  not  get  cleared  with 
each  of  the  button  presses  or  clear  keys  (one  of  the  algebraic  calcula¬ 
tors  has  3  different  clear  keys).  They  tended  toward  caution:  exces¬ 
sively  clearing  when  they  wanted  the  calculator  to  be  restarted,  and 
exhibiting  reluctance  to  use  CLEAR  during  a  problem  for  fear  of  clearing 
too  much. 

A  similar  pattern  applied  to  the  use  of  the  ENTER  button  on  the 
stack  calculator.  They  would  push  it  too  much,  often  while  commenting 
that  they  knew  this  to  be  excessive,  but  that  is  what  they  had  learned 
to  do.  They  explained  their  actions  by  saying  such  things  as  "It 
doesn't  hurt  to  hit  it  extra"  or  "I  always  hit  it  twice  when  I  have  to 
enter  a  new  phrase  —  its  just  a  superstition,  but  it  makes  me  feel  more 
comfortable." 
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These  behaviors  seem  to  reflect  some  of  the  properties  of  mental 
models,  especially  the  ease  of  generating  rules  that  have  great  preci¬ 
sion  and  of  keeping  separate  the  rules  for  a  number  of  very  similar,  but 
different  devices.  The  rule  to  hit  the  CLEAR  button  excessively  allows 
the  user  to  avoid  keeping  an  accurate  count  of  the  operation.  Moreover, 
it  provides  a  rule  that  is  functional  on  all  calculators,  regardless  of 
design,  and  that  also  makes  the  user  resistant  to  slips  of  action  caused 
by  forgetting  or  interference  from  other  activities.  All  in  all,  it 
seems  a  sensible  simplification  that  eases  and  generalizes  what  would 
otherwise  be  a  more  complex,  machine  specific  set  of  knowledge. 

When  people  attribute  their  actions  to  superstition  they  appear  to 
be  making  direct  statements  about  limitations  in  their  own  mental 
models.  The  statement  implies  uncertainty  as  to  mechanism,  but  experi¬ 
ence  with  the  actions  and  outcomes.  Thus,  in  this  context,  supersti¬ 
tious  behavior  indicates  that  the  person  has  encountered  difficulties 
and  believes  that  a  particular  sequence  of  actions  will  reduce  or  elim¬ 
inate  the  difficulty. 

Finally,  there  seemed  to  be  a  difference  in  the  trade-off  between 
calculator  operations  and  mental  operations  that  the  people  I  studied 
were  willing  to  employ.  For  problems  of  the  sort  that  I  was  studying, 
the  four-function  machine  was  the  most  difficult  to  use.  Considerable 
planning  was  necessary  to  ensure  that  the  partial  answers  from  the  sub¬ 
parts  of  the  problem  could  be  stored  in  the  machine  memory  (most  four- 
function  calculators  only  have  one  memory  register).  As  a  result,  the 
users  seemed  to  prefer  to  write  down  partial  sums  and  to  do  simple  com¬ 
putation  in  their  heads  rather  than  with  the  machine.  With  the  stack 
machine,  however,  the  situation  is  reversed.  Although  the  machine  is 
difficult  to  learn,  once  it  is  learned,  expert  users  feel  confident  that 
they  can  do  any  problem  without  planning:  They  look  at  the  problem  and 
immediately  start  keying  in  the  digits. 

On  Modeling  a  Mental  Model 

Consider  the  problem  of  modeling  some  particular  person's  mental 
model  of  some  particular  target  system.  Let  the  particular  target  sys¬ 
tem  be  called  t.  Before  we  can  understand  how  a  person  interacts  with  a 
target  system,  we  need  to  have  a  good  conceptualization  of  that  system. 
In  other  words,  we  need  a  conceptual  model  of  the  system:  call  the  con¬ 
ceptual  model  of  £,  C(t ) .  And  now  let  the  user's  mental  model  of  that 
target  system  be  called  M(t). 

We  must  distinguish  between  our  conceptualization  of  a  mental 
model,  C(M( t) ) ,  and  the  actual  mental  model  that  we  think  a  particular 
person  might  have ,  M( t ) .  To  figure  out  what  models  users  actually  have 
requires  one  to  go  to  the  users,  to  do  psychological  experimentation  and 
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observation.  ^ 

In  order  to  effectively  carry  out  such  observation  and  experimenta¬ 
tion,  we  need  to  consider  both  representational  and  functional  issues. 
Let  me  discuss  three  of  the  necessary- properties:  belief  systems,  obser¬ 
vability,  and  predictive  power. 

These  three  functional  considerations  —  belief  systems,  observa¬ 
bility,  and  predictive  power  —  apply  to  both  the  mental  model  and  our 
conceptualization  of  the  model,  to  both  M(t)  and  C(M(t)).  They  can  be 
summarized  in  this  way: 

Belief  system.  A  person's  mental  model  reflects  the  person's 
beliefs  about  the  physical  system,  acquired  either  through  observation, 
instruction,  or  inference.  The  conceptual  model  of  the  mental  model 
C(M(t) ) ,  should  contain  a  model  of  the  relevant  parts  of  the  person's 
belief  system. 

Observability.  There  should  be  a  correspondence  between  the  param¬ 
eters  and  states  of  the  mental  model  that  are  accessible  to  the  person 
and  the  aspects  and  states  of  the  physical  system  that  the  person  can 
observe.  In  the  conceptual  model  of  the  mental  model,  this  means  that 
there  should  be  a  correspondence  between  parameters  and  observable 
states  of  C(M(t))  and  the  observable  aspects  and  states  of  t. 

Predictive  power .  The  purpose  of  a  mental  model  is  to  allow  the 
person  to  understand  and  to  anticipate  the  behavior  of  a  physical  sys¬ 
tem.  This  means  that  the  model  must  have  predictive  power,  either  by 
applying  rules  of  inference  or  by  procedural  derivation  (in  whatever 
manner  these  properties  may  be  realized  in  a  person);  in  other  words,  it 
should  be  possible  for  people  to  "run"  their  models  mentally.  This 
means  that  the  conceptual  mental  model  must  also  include  a  model  of  the 


2.  Let  me  warn  the  non-psychologists  that  discovering  what  a  person's 
mental  model  is  like  is  not  easily  accomplished.  For  example,  you  can¬ 
not  simply  go  up  to  the  person  and  ask.  Verbal  protocols  taken  while 
the  person  does  a  task  will  be  informative,  but  incomplete.  Moreover, 
they  may  yield  erroneous  information,  for  people  may  state  (and  actual¬ 
ly  believe)  that  they  believe  one  thing,  but  act  in  quite  a  different 
manner.  All  of  a  person's  belief  structures  are  not  available  to  in¬ 
spection,  especially  when  some  of  those  beliefs  may  be  of  a  procedural 
nature.  And  finally,  there  are  problems  with  what  is  called  the  "demand 
structure”  of  the  situation.  If  you  ask  people  why  or  how  they  have 
done  something,  they  are  apt  to  feel  compelled  to  give  a  reason,  even  if 
they  did  not  have  one  prior  to  your  question.  They  ard  apt  to  tell  you 
what  they  believe  you  want  to  hear  (using  their  mental  models  of  your 
expectations).  Having  then  generated  a  reason  for  you,  they  may  then 
believe  it  themselves,  even  though  it  was  generated  on  the  spot  to 
answer  your  question.  On-line  protocols  generated  while  in  the  act  of 
problem  solving  and  that  give  descriptions  of  activities  rather  than  ex¬ 
planations  are  much  more  reliable. 
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relevant  human  information  processing  and  knowledge  structures  that  make 
it  possible  for  the  person  to  use  a  mental  model  to  predict  and  under¬ 
stand  the  physical  system. 

On  the  Relationship  between  Conceptual  and  Mental  Models 

Conceptual  models  are  devised  as  tools  for  the  understanding  or 
teaching  of  physical  systems.  Mental  models  are  what  people  really  have 
in  their  heads  and  what  guide  their  use  of  things.  Ideally,  there  ought 
to  be  a  direct  and  simple  relationship  between  the  conceptual  and  the 
mental  model.  All  too  often,  however,  this  is  not  the  case. 


That  a  mental  model  reflects  the  user's  beliefs  about  the  physical 
system  seems  obvious  and  has  already  been  discussed.  What  is  not  so 
obvious  is  the  correspondence  that  should  hold  between  the  mental  model 
and  a  conceptual  model  of  the  physical  system,  that  is,  between  M(t)  and 
C(t) . 


In  the  literature  on  mathematical  learning  models,  Greeno  and 
Steiner  (1964)  introduced  the  notion  of  "identifiability."  That  is, 
they  pointed  out  that  a  useful  model  will  have  a  correspondence  between 
the  parameters  and  states  of  the  model  and  the  operation  of  the  target 
system.  I  find  that  these  remarks  apply  equally  well  to  the  problems  of 
mental  models.  It  is  important  that  there  be  a  correspondence  between 
the  parameters  and  states  of  one's  model  and  the  things  one  is  attempt¬ 
ing  to  describe.  This  restriction  does  pose  some  strong  constraints  upon 
the  nature  of  the  mental  model.  Certain  kinds  of  mental  models  will  be 
ruled  out  if  the  identification  cannot  be  easily  made. 

A  major  purpose  of  a  mental  model  is  to  enable  a  user  to  predict 
the  operation  of  a  target  system.  As  a  result,  the  predictive  power  of 
such  a  model  is  of  considerable  concern.  Although  great  stress  is  laid 
in  this  book  to  the  notion  of  "running"  a  conceptual  or  mental  model,  it 
should  also  be  possible  to  make  predictions  by  straightforward  infer¬ 
ence,  a  declarative  form  of  predictability,  rather  than  the  implied 
notion  of  procedural  running  of  a  model.  Whatever  the  mechanism,  it  is 
clear  that  prediction  is  one  of  the  major  aspects  of  one's  mental 
models,  and  this  must  be  captured  in  any  description  of  them. 

The  System  Image 

In  the  ideal  world,  when  a  system  is  constructed,  the  design  will 
be  based  around  a  conceptual  model.  This  conceptual  model  should  govern 
the  entire  human  interface  with  the  system,  so  that  the  image  of  that 
system  seen  by  the  user  is  consistent,  cohesive,  and  intelligible.  I 
call  this  image  the  system  image  to  distinguish  it  from  the  conceptual 
model  upon  which  it  is  based  and  the  mental  model  one  hopes  the  user 
will  form  of  the  system.  The  instruction  manuals  and  all  operation  and 
teaching  of  the  system  should  then  be  consistent  with  this  system  image. 
Thus,  the  instructors  of  the  system  would  teach  the  underlying  concep¬ 
tual  model  to  the  user  and,  if  the  system  image  is  consistent  with  that 
model,  the  user's  mental  model  will  also  be  consistent. 
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For  this  to  happen,  the  conceptual  model  that  is  taught  to  the  user 
must  fulfill  three  criteria: 

Learnability 

Functionality 

Usability 

What  good  is  a  conceptual  model  that  is  too  difficult  to  learn?  Or  a 
model  that  has  little  functionality,  failing  to  correspond  to  the  system 
image  or  failing  to  predict  or  explain  the  important  aspects  of  the  tar¬ 
get  system?  Or  what  of  a  conceptual  model  that  cannot  easily  be  used, 
given  the  properties  of  the  human  information  processing  structure  with 
its  limited  short  term  memory  and  limited  ability  to  do  computations? 

Alas,  all  too  often  there  is  no  correspondence  among  the  conceptual 
model  of  the  system  that  guided  the  designer,  the  system  image  that  is 
presented  to  the  user,  the  material  in  the  instructional  manuals  and 
that  is  taught  to  the  user,  and  the  mental  models  of  the  user.  Indeed, 
for  many  target  systems,  there  is  no  single  conceptual  model  that  was 
followed  in  the  design.  The  stack  calculator  gives  us  a  good  positive 
instance  where  a  conceptual  design  was  neatly  implemented  into  a  con¬ 
sistent  physical  device,  with  the  operations  and  instructions  all  based 
around  the  same  basic  model.  It  should  be  no  surprise,  therefore,  that 
in  my  studies,  users  of  this  calculator  were  most  confident  of  their 
abilities. 
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ABSTRACT 

I  argue  from  studies  of  human  performance,  including  slips 
of  action  and  skilled  typing  that  human  processing  structures  are  of 
a  special  sort,  with  weak  binding  between  functions  and  arguments, 
with  strong  excitatory  and  inhibitory  interactions  among  simultane¬ 
ous  processes,  and  with  the  parts  of  action  sequences  neither 
strongly  ordered  nor  tightly  coupled.  I  argue  that  analyses  of  hu¬ 
man  performance  imply  a  class  of  processing  structures  quite 
different  than  is  commonly  envisioned  within  Artificial  Intelligence. 


I.  How  do  people  do  more  than  one  thing  at  a  time? 

An  important  aspect  of  everyday  behavior  is  that  we  do 
several  different  activities  at  the  same  lime,  oftentimes  for  simul¬ 
taneous  (and  possibly  conflicting)  purposes.  Even  when  we  do  not 
attempt  simultaneous  actions,  we  still  might  be  planning  or  review¬ 
ing  one  set  of  things  while  performing  or  accomplishing  another. 
We  delay  and  defer  goals  or  actions  as  needed,  wailing  for  appropri¬ 
ate  times  for  them  to  be  accomplished.  This  occurs  for  several  rea¬ 
sons.  Some  biological  goals  do  not  need  to  be  satisfied  at  any  par¬ 
ticular  instant,  but  within  reason,  can  be  executed  at  convenience 
(e.g.,  such  things  as  eating,  sleeping,  or  toilet  activities).  Some  dai¬ 
ly  tasks  have  similar  characteristics  (e.g.,  going  to  the  bank  or  post 
office,  purchasing  some  needed  item).  Some  tasks  have  to  be  de¬ 
ferred  because  there  is  not  sufficient  time  or  information  to  com¬ 
plete  them  during  one  session  of  work  (e.g.,  writing  a  scientific  pa¬ 
per,  reading  a  book,  learning  a  complex  task).  Finally,  even  for 
tasks  that  are  continually  active  from  start  to  completion,  they  may 
span  such  a  long  duration  that  other  things  are  also  done  along  the 
way,  and  the  individual  components  of  the  major  task  may  have  to 
wait  for  minutes  or  even  hours  before  being  executed. 

These  problems  appear  to  be  analogous  to  the  scheduling 
problems  of  modern  real-time  computers,  and  some  of  the  analyses 
from  that  field  are  relevant.  However,  the  human  is  a  special  kind 
of  biological  processor,  and  I  suspect  that  suprisingly  little  of  what 
we  know  of  time-shared  computers  applies  to  the  human.  The 
difficulties  in  doing  two  or  more  tasks  at  the  same  lime  are  well 
known.  There  are  only  two  ways  that  a  system  can  do  two  or  more 
things  together  at  the  same  time.  One  way  is  to  have  sufficient  pro¬ 
cessing  machinery  that  the  two  tasks  use  different  resources  and  do 
not  interact.  The  second  way  is  to  switch  back  and  forth  between 
the  two,  saving  the  complete  status  of  the  current  state  before 
switching  tasks  and  then  restoring  the  state  completely  when 
switching  back. 

Which  method  do  people  use?  There  is  clear  evidence  for 
both.  Different  processing  structures  control  walking  and  talking, 
eating  and  seeing.  The  same  processors  are  switched  among  tasks 
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when  we  listen  first  to  this  conversation,  then  to  that,  or  when  driv¬ 
ing  a  car  while  conversing,  looking  first  at  the  road,  then  at  the 
passenger.  The  interesting  cases  arise  when  neither  solution  seems 
applicable  because  the  several  tasks  interact  with  one  another. 
Some  kinds  of  mental  activity  can  cause  pupil  size  to  increase  (as 
expert  poker  players  know).  We  hear  better  in  the  direction  in 
which  we  are  looking  (even  if  we  do  not  turn  the  head)  and,  con¬ 
versely,  it  is  hard  to  ignore  the  sounds  from  the  direction  in  which 
we  look,  even  when  we  are  trying  to  listen  to  something  else  [12]. 
Novices  cannot  tap  different  rhythms  with  different  hands,  but  ex¬ 
pert  musicians  can.  Thoughts  can  intrude  upon  actions.  The  initia¬ 
tion  of  action  can  interrupt  thought.  Emotions  -  and  even  such 
things  as  hunger  -  can  disrupt  thought.  We  tend  to  remember  sad 
things  when  we  are  sad  and  happy  things  when  we  are  happy. 
Different  parts  of  our  system  intrude  upon  others,  apparently  in 
subtle,  continuous  ways,  a  point  exploited  by  Freud. 


A.  Studies  of  attention  (psychology)  and  time-sharing  (computer 
science)  do  not  provide  helpful  information 

These  characteristics  of  real  behavior  pose  some  interesting 
anil  important  puzzles  for  students  of  human  information  process¬ 
ing.  We  know  little  about  how  such  multiple  goals  and  tasks  get 
scheduled  and  accomplished.  There  has  not  been  much  study  of 
this  aspect  of  behavior.  This  is  especially  true  in  view  of  the 
psychological  literature  on  simultaneous  attention  that  argues 
strongly  for  limits  on  our  ability  to  do  several  tasks  at  any  one  time. 
I  myself  have  argued  such  a  point,  telling  audiences  of  undergradu¬ 
ates  how  people  are  limited  to  doing  roughly  one  thing  at  a  time. 
Of  course,  while  I  say  this,  I  am  pacing  back  and  forth  in  front  of 
the  class,  avoiding  the  table  and  chair  in  my  path,  juggling  a  piece 
of  chalk  from  hand  to  hand,  planning  (he  remainder  of  the  lecture, 
and  worrying  about  how  I  am  going  to  get  through  the  demands  or 
the  rest  of  the  day.  My  actions  contradict  my  speech,  but  in  actual¬ 
ity,  it  is  even  worse.  Any  one  of  the  "single"  things  I  am  doing  is  a 
complex  set  of  overlapping  activities.  The  act  of  speaking,  for  ex¬ 
ample,  involves  many  components,  many  of  which  should  really  be 
considered  separate  tasks.  In  speaking,  there  is  the  high  level  plan¬ 
ning  of  the  utterance,  the  formation  of  the  structure  of  the  sen¬ 
tences,  the  proper  morphological  selection  and  construction  of  the 
words,  and  the  complex  control  of  the  speech  organs  and  of  the 
numerous  muscles  in  the  face,  mouth,  throat,  and  chest  that  must 
operate  in  parallel  with  overlapping  control  signals.  Thus,  even  a 
so-called  single  task  is  really  many  simultaneous  tasks 

Psychologists  deal  with  this  apparent  contradiction  between 
theoretical  belief  and  reality  by  talking  of  the  distinction  between 
automatic  and  non-automatic  actions,  staling  that  automatic  acts  are 
not  under  conscious  control  and  do  not  require  attentional 
resources.  As  a  result,  there  is  no  limit  on  how  many  of  these  can 
be  done  at  any  one  time,  as  long  as  there  is  no  conflict  in  the  use 
of  any  particular  physical  or  psychological  structure  The  trouble 
with  this  explanation  is  that  it  doesn't  tell  us  anything  about  how  it 
is  actually  accomplished.  To  be  polite  to  my  field,  1  will  make  the 
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excuse  that  this  explanation  is  still  at  an  infant  stage  of  develop¬ 
ment.  The  statement  allows  us  to  reconcile  our  observations  of  real 
behavior  with  the  theoretical  belief  in  attentional  limitations  by  say¬ 
ing  that,  weli,  not  everything  requires  attention,  not  once  it  is  well 
learned  Regardless  of  what  you  might  think  of  the  statement  and 
of  the  lack  of  specificity  in  the  arguments,  there  is  another  problem 
with  the  approach,  the  attentional  limitations  are  only  part  of  the 
problem.  We  still  don’t  know  how  any  organism  can  simultaneous¬ 
ly  perform  many  tasks  What  kind  of  structures  are  necessary,  and 
which  are  really  present  in  the  human?  How  can  we  account  for 
the  errors  that  people  make? 

Now  turn  to  computers  and,  in  particular,  the  work  in 
Artificial  Intelligence  Let  me  quickly  assure  half  of  my  audience  — 
and  warn  the  other  half  --  that  Ai  doesn’t  have  any  idea  of  how  to 
handle  the  problem  either.  The  relationship  between  the  study  of 
Artificial  Intelligence  and  human  intelligence  should  go  two  ways, 
and  although  psychologists  have  often  taken  more  from  Al  than  AI 
has  taken  from  us,  I  think  the  direction  of  the  information  flow  is 
cnanging.  In  this  case  we  are  equals,  there  is  only  a  weak  ebb 
between  two  stagnant  pools. 

Most  of  the  intelligent  programs  that  have  so  far  been 
developed  within  AI  are  single  minded,  experts  in  their  single 
domain  of  inquiry,  but  unable  to  deal  with  any  other  domain.  Even 
when  there  are  systems  that  can  deal  with  several  different  domains 
or  sub-domains  of  a  topic,  they  do  them  in  a  sensible  fashion,  one 
at  a  time,  rather  than  in  the  inelegant,  cluttered  human  fashion  of 
attempting  to  think  of  everything  at  once,  mixing  up  the  concepts 
of  one  with  those  of  the  other  The  virtue  for  the  computer  is 
elegance  and  power.  The  virtue  for  the  human  is  creativity  and 
flexibility. 

B.  Human  error  is  suggestive  of  a  special  form  of  mechanism 

I  want  to  argue  for  a  different  kind  of  processing  mechanism 
than  is  usually  considered  by  people  within  Artificial  Intelligence. 
In  the  end,  it  may  not  be  wise  to  model  many  aspects  of  human  in¬ 
telligence  with  conventional  processing  structures.  But  before  I  get 
to  that,  let  us  review  the  argument. 

The  multiple-purpose,  multiple  processing  aspect  of  our 
behavior  leads  to  difficulties.  I  have  already  listed  some  phenome¬ 
na  that  imply  interactions  among  processing  structures.  In  this  pa¬ 
per  I  concentrate  upon  the  form  of  human  errors.  Thus,  we  make 
errors.  We  are  easily  distracted  by  events,  slopping  to  do  things  we 
had  not  intended,  or  we  are  captured  by  habitual  acts,  performing 
them  instead  of  the  ones  intended.  At  times,  we  can  be  data 
driven,  responding  to  sensory  signals,  whether  we  intended  to  or 
not.  This  can  be  useful,  for  it  allows  us  to  react  appropriately  to 
unexpected  events  in  the  environment  It  is  not  so  useful  when 
data  driven  processing  ime"rupts  our  intended  actions,  at  times  so 
distracting  us  from  our  intentions  that  we  neglect  to  complete 
them.  These  errors  imply  that  we  neither  separate  the  tasks  well 
nor  switch  completely  among  them  As  a  result,  we  intermix  com¬ 
ponents,  lose  track  of  our  status  on  any  given  task,  and  oftentimes 
do  the  right  thing  on  the  wrong  occasion 

Errors  give  insight  into  the  system,  for  they  offer  powerful 
clues  as  to  the  operation  of  the  underlying  mechanism.  We  need 
not  agree  with  Freud's  view  that  "the  meaning  in  them  is  unmistak¬ 
able,  even  to  the  dullest  intelligence,  and  strong  enough  to  impress 
even  the  most  critical  judgment",  but  we  can  still  agree  that  they 
are  strongly  suggestive.  Errors  can  be  divided  into  several  different 
categories  I  divide  errors  into  two  major  classes:  mistakes  and 
slips,  with  the  division  being  whether  the  error  occurred  prior  to  or 
after  the  formation  of  the  highest  level  intention.  I  define  a  mis¬ 
take  to  be  an  error  in  forming  the  intention.  Thus,  a  mistake  can 
result  from  knowledge  that  is  erroneous  or  incomplete,  either  in 


the  information  that  the  person  brings  to  the  situation  or  that  is 
available  from  the  environment.  The  mistake  can  also  arise  in  the 
psychological  mechanisms  of  decision  and  planning  that  are  in¬ 
volved  in  the  formation  of  the  intention.  1  define  a  slip  to  be  a 
failure  in  carrying  out  the  intention  properly.  That  is,  the  appropri¬ 
ate  action  is  started,  but  somewhere  along  the  path  of  execution  it 
is  diverted  or  deflected. 

There  are  several  collections  of  slips  12,3,9,11).  The  in¬ 
stances  are  both  humorous  and  informative.  A  business  executive 
roared  "Come  in’  instead  of  "Hello"  when  answering  the  telephone. 
A  friend  politely  said  "Come  in’  instead  of  "Sit  down"  when  inviting 
a  new  person  to  join  the  two  of  us  at  a  table  in  a  hotel  restaurant  * 
Pilots  have  raised  the  landing  gear  instead  of  the  flaps.  One  person 
reported  cleaning  a  fish  and  throwing  the  cleaned  fish  overboard, 
keeping  the  entrails.  In  preparing  for  a  party,  one  person  put  the 
cake  in  the  refrigerator  and  the  salad  in  the  oven.  Computer  users 
report  numerous  errors:  typing  commands  into  the  text  editor 
while  in  “insert"  mode,  or  text  while  in  "command"  mode,  deleting 
files  instead  of  moving  them.  There  are  data-driven  errors,  in 
which  the  sight  of  something  leads  to  an  unintended  action  -  one 
of  my  students  calls  this  the  "parking  spot  error":  if  you  come 
across  a  parking  spot  while  driving  through  a  city,  you  may  find 
yourself  parked  in  it,  even  if  you  had  no  intention  of  stopping 
there.  (The  same  student  reports  dashing  into  an  elevator  that  hap¬ 
pened  to  open  its  doors  just  as  he  was  walking  by,  even  though  he 
hadn’t  meant  to  take  an  elevator.)  A  reasonably  common  typing  er¬ 
ror  is  the  "doubling  error":  doubling  the  wrong  letter  in  a  word, 
yielding  bokk  or  claas  instead  of  book  or  class. 

Examples  of  slips  can  be  found  in  both  speech  and  motor  ac¬ 
tions.  One  example  is  to  select  the  wrong  word,  as  in:  “Wouldn’t 
it  be  cheaper,  I  mean  faster,  to  go  that  way?"  I  classify  this  as  a 
"description*  error,  one  that  results  from  an  error  in  memory  re¬ 
trieval.  The  word  that  was  first  retrieved  shares  features  of  the  se¬ 
mantic  description  of  the  intended  word.  The  error  can  per- 
severate,  as  in:  "They  have  Chinee  -  Japa  -  Mexican  food  to  go." 

There  are  other  forms  of  verbal  slips.  A  blend  occurs  when 
two  competing  patterns  are  merged,  as  in  "dut"  which  merges 
“close"  and  “shut."  In  a  Spoonerism,  components  of  the  words  are 
interchanged,  as  in:  “Ruman  and  Normalharl"  instead  of  the  in¬ 
tended  "Norman  and  Rumelhart."  (The  examples  come  from  Nor¬ 
man  (9),  and  Fromkin  (2,3).) 

Freud  made  the  point  that  most  errors  have  multiple  causes, 
and  that  seems  to  be  true  of  these  as  well.  For  the  several  people 
who  have  reported  going  to  their  bedroom  to  change  clothes  for 
dinner  and  finding  themselves  undressed  and  in  bed,  they  may 
have  been  "captured”  by  performing  the  initial  stages  of  a  familiar 
habit  and  unconsciously  completing  the  familiar  instead  of  the  in¬ 
tended,  but  they  may  also  have  been  unconsciously  attempting  to 
avoid  the  dinner.  The  invitation  to  "Come  in"  to  the  restaurant 
table  could  have  been  affected  by  the  fact  that  one  of  us  was  silling 
in  a  semi-enclosed  booth  (and  the  person  who  made  the  slip  so  ar¬ 
gued).  In  my  experience,  these  subtle,  clinical  interpretations  seem 
initially  far-fetched,  but  are  confirmed  with  surprising  frequency  by 
the  people  who  mske  the  slips  Thus  the  puzzle  for  those  who  wish 
to  figure  out  the  mechanism,  how  do  different  sources  of  informa¬ 
tion  interact  to  lead  to  slips  (while  also  accounting  for  the  fact  that 
most  of  our  actions  are  correct)? 

The  various  phenomena  I  have  described,  plus  others,  imply 
that  the  parts  of  action  sequences  are  neither  strongly  ordered  nor 
tightly  coupled  That  is,  I  think  that  the  biological  system  is  struc- 


’  All  the  slips  reported  in  this  piper  hive  been  collecied  with  some  cire  is  io  aocu- 
racy,  md  with  ihe  original  intention  vended  by  ihe  perpetrator  See  the  original 
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lured  so  as  to  use  ambiguous  information  for  memory  search,  to  al¬ 
low  itself  to  be  responsive  to  multiple  sources  of  information,  to 
combine  and  overlap  data  paths,  and  to  deliberately  intermix  what 
one  would  have  thought  to  be  independent  processing  streams. 
Although  these  properties  can  lead  to  errors,  l  believe  that  they  are 
also  exactly  the  sort  of  thing  that  gives  us  much  of  the  power  of 
human  creativity  and  judgement,  to  allow  us  to  be  tolerant  of  noise 
and  of  error,  to  behave  flexibly,  to  respond  in  imaginative  and 
creative  ways  to  novel  events,  and  to  be  able  to  shift  our  strategies 
and  behavior  when  the  situation  shifts. 

The  basic  concept  is  simple.  We  assume  that  the  human  in¬ 
formation  processing  system  is  mediated  by  means  of  many 
sepaia.c  processing  structures,  each  of  which  can  do  only  simple 
operations,  but  each  of  which  is  coupled  to  numerous  other  struc¬ 
tures.  We  call  these  structures  schemas,  and  we  allow  each  to  have 
an  activation  value  that  excites  or  inhibits  its  neighboring  schemas 
and  is  triggered  into  controlling  an  action  sequence  whenever  the 
combination  of  its  activation  value  and  the  goodness-of-fil  of  its 
specific  trigger  conditions  exceed  a  threshold  value.  (For  a  closely 
related  argument  and  description  of  computational  structures,  see 
(1|.)  For  present  purposes,  all  that  is  needed  is  the  understanding 
that  there  are  independent  processing  structures,  each  capable  of 
controlling  action,  and  that  synchronization  and  cooperation  among 
them  is  handled  by  activation  and  inhibition  links  among  schemas. 
More  discussion  can  be  found  in  (7,8,9,10,13). 

TABLE  1 

CLASSIFICATION  OF  ACTION  SLIPS 

(Adapted  from  Norman.  [9)1 

I  Slips  in  the  tor  mi  non  of  the  intention 

A.  Mode  errors  erroneous  classification  of  the  situation 

B  Description  errors  ambi|uous  or  or  incomplete  specification  of  the  inten¬ 
tion 

II  Slips  that  result  from  faulty  activation  of  schemas 

A  Unintentional  activation 

1  Capture  errors:  when  ihe  intended  sequence  is  similar  to  another. 

better  learned  or  more  frequent  sequence,  the  latter  may  fain  con¬ 
trol 

2  Data-driven  activation:  external  events  activate  schemas 

3.  Associative  activation:  currently  active  schemas  activate  others  with 
which  they  are  associated 

B.  Loss  of  activation 

1  Forfeiting  an  intention  (but  continuing  with  the  sequence} 

2  Misordering  the  components  of  a  sequence 

3  Leaving  oui  steps  in  a  sequence 

4  Repeating  steps  in  a  sequence 

III  Slips  that  result  from  faulty  triggering  of  active  schemas 

A  False  triggering  a  properly  activated  schema  is  triggered  at  an  inappropri¬ 
ate  time 

1  Spoonerisms  reversals  of  event  components 

2  Blends  combinations  of  components  From  two  competing  schemas 

3  Thoughts  leading  to  actions  triggering  of  schemas  only  meant  to 
be  thought,  not  executed 

4  Premature  triggering 

B  Failure  to  trigger 

1  The  action  was  preempted  by  competing  schemas 

2  There  was  insufficient  activation 

3  The  trigger  conditions  failed  to  match 

Action  slips  come  in  many  different  varieties.  I  have  at¬ 
tempted  the  analysis  shown  in  Table  I,  based  upon  a  theoretical 
framework  that  assumes  that  actions  are  caused  by  the  activation 
and  triggering  of  schemas. 


II.  Studies  of  skilled  behavior  provide  more  clues 


A.  Skilled  typing  has  interesting  properties 

Another  source  of  information  about  how  people  do  simul¬ 
taneous  actions  comes  from  the  study  of  skilled  tasks  One  such 


task  is  expert  typing,  and  detailed  study  of  the  typist  reveals  some 
interesting  insight- into  the  nature  of  skilled  human  performance. 
Typing  is  a  single  task  that  requires  multiple  control  of  the  10 
fingers  and  2  hands  -  there  are  60  tendons  and  30  joints  involved 
simply  in  the  movement  of  the  fingers.  Study  of  typing  is  today 
one  of  the  major  themes  in  our  laboratory,  and  thp  analyses  of  typ¬ 
ing  errors  and  typing  performance  tell  us  quite  a  bit  about  the  na¬ 
ture  of  cooperative  interaction  among  simultaneous  activities.  At 
this  point  I  will  only  mention  two  aspects  of  skilled  typing.  One  is 
the  doubling  error  in  which  the  wrong  letter  in  a  word  is  doubled, 
so  that  a  word  like  book  or  manner  is  typed  as  bokk  or  manner. 
The  other  is  the  overlapping  nature  of  the  execution  of  the  finger 
movements  (4).  The  finger  movements  start  several  letters  ahead 
of  their  scheduled  arrival  time,  oftentimes  out  of  sequence  of  the 
final  temporal  order  in  which  they  are  made.  It  is  as  if  each  finger 
starts  as  soon  as  it  can  towards  its  intended  target,  and  the  hand  ap¬ 
pears  to  cooperate,  configuring  itself  so  as  to  make  maximum 
movement  towards  as  many  targets  at  a  time  as  possible. 

This  latter  example  is  important,  for  it  illustrates  a  situation 
in  which  simultaneous  tasks  cooperate  rather  than  compete.  This 
cooperation  among  possible  competitive  tasks  happens  frequently. 
Suppose  you  wish  to  pick  up  several  pencils  and  a  piece  of  paper  at 
the  same  time,  using  only  one  hand.  The  normal  finger  movements 
that  would  be  performed  were  only  one  object  to  be  picked  up  are 
modified  to  allow  for  cooperation  among  the  fingers  and  hand  to  ac¬ 
complish  the  multiple  goal.  I  predict  that  one  of  the  changes  that 
occur  in  performance  as  a  person  becomes  expert  is  a  change  from 
mutual  competition  of  simultaneous  actions  to  mutual  cooperation. 
The  behavior  therefore  changes  from  doing  but  a  single  action  at  a 
time  to  overlapping,  cooperative  performance  of  several  simultane¬ 
ous  acts. 

TABLE  2 

THE  BASIC  PHENOMENA  OF  TYPING 

(Adapted  from  Rumelhart  &  Norman,  (14)) 

I.  The  liming  of  keystroke* 

A.  People  can  type  very  quickly. 

B  Crocs  hand  interstroke  intervals  are  shorter  than  those  within  hands 
C  Within  hand  interstroke  intervals  appear  to  be  a  function  of  the  reach 
from  one  to  ihe  next. 

D.  The  time  for  a  particular  intersiroke  interval  can  depend  on  the  context  in 
which  it  occurs. 

E  There  is  a  negative  correlation  between  the  intervals  on  successive 
strokes-especially  when  the  alternate  strokes  occur  on  alternate  hands 

II  Pattern  of  Errors 

A  Transposition  Errors 
B  Doubling  Error 
C  Alternation  reversal  errors 
D  Homologous  errors 
E  Capture  errors 

F.  Omission  errors 

G.  Misslrokes 

III  The  general  organization  of  typing 

A  Skilled  typists  move  their  hands  towards  the  keys  in  parallel 
B  The  units  of  typing  seem  to  be  largely  at  the  word  level  or  smaller 
C  Sequences  involving  cross  hand  strokes  seem  to  take  longer  to  program 
than  those  involving  only  within  hand  strokes 

Studies  of  typing  reveal  a  number  of  phenomena  that  provide 
considerable  constraints  on  the  possible  mechanisms  that  could  be 
responsible  for  (he  actions.  A  list  of  the  phenomena  we  have  ex¬ 
amined  ts  presented  in  Table  2. 

B.  The  doubling  error  implies  that  there  is  no  type-token  distinc¬ 
tion 

Consider  the  doubling  error  How  could  it  come  about1’  In 
out  attempt  to  devise  a  formal  model  of  the  typing  process  i 1 4] .  we 
took  special  note  of  errors  of  doubling  and  alternation.  (An  alter¬ 
nation  occurs  in  a  word  like  these  in  which  the  e  alternates,  but 
when  typed,  the  wrong  letter  is  alternated,  as  in  thses.)  The  ex- 


ing  review  of  this  concept,  see  [6].) 


istence  or  of  doubling  and  alternation  errors  pose  special  problems. 
Consider  the  word  book.  According  to  our  arguments,  the  word 
would  be  represented  by  schemas  for  each  of  the  letters:  book.  It 
is  easy  to  see  how  such  a  representation  could  lead  to  transposition 
errors  (such  as  boko)  but  not  to  doubling  errors.  It  would  be  easy 
to  make  up  a  schema  for  a  doubled  letter  (so  that  the  word  would 
be  represented  by  the  schemas  b  double-o  k),  but  this  would  not 
lead  to  the  doubling  errors  either. 

The  doubling  error  turns  out  to  have  two  major  implications. 
First,  it  implies  that  there  are  special  schemas  that  signal  the  ex¬ 
istence  of  doubled  letters,  and  that  occasionally  these  schemas  get 
applied  to  the  wrong  letters.  In  a  computational  terms,  this  means 
that  the  binding  between  the  arguments  of  the  special  schemas  for 
doubling  occasionally  get  made  improperly.  Second,  the  need  for  a 
special  schema  to  mark  doubled  letters  implies  a  difficulty  in  having 
the  regular  letter  schema  signal  the  double.  Why  isn't  the  word 
book  represented  by  the  schemas  book?  The  reason  would  seem 
to  be  thai  this  would  require  two  instances  (types)  of  the  schema 
lor  o.  the  existence  of  the  doubling  error  implies  that  such  repeated 
tokens  of  a  schema  might  not  be  possible. 

Thus,  the  existence  of  doubling  errors  forced  us  to  a  pure 
"type"  model,  in  which  each  letter  could  only  have  a  single  keypress 
schema;  the  keypress  schemas  exist  only  as  "types,"  with  no  "token" 
schemas.  There  must  be  a  special  schema  that  signals  the  presence 
of  a  doubled  letter.  Moreover,  there  must  be  a  weak  binding 
between  the  special  schema  and  the  arguments  upon  which  it 
operates.  In  our  model,  we  let  the  binding  be  established  via  ac¬ 
tivation  values,  with  noise  sometimes  leading  to  errors  in  the  bind¬ 
ing.  The  existence  of  alternation  errors  led  to  the  same  conclusion; 
special  schemas  that  signal  the  presence  of  alternating  letters,  with 
a  weak  binding  between  the  schema  and  its  arguments. 


III.  On  possible  psychological  mechanisms 

We  see  that  there  are  several  different  aspects  of  skilled 
behavior: 

1  Competition  among  actions,  so  that  the  doing  of  one 
thing  inhibits  the  doing  of  another.  For  some  combina¬ 
tions  of  actions,  the  mechanisms  required  are  incompati- 
ble,  so  thai  the  competition  is  necessary  and  in  these 
cases  some  sort  of  priority  or  inhibitory  processes  are  re¬ 
quired 

2  Cooperation  among  actions,  so  that  the  operations  of  one 

action  are  modified  to  accommodate  another  In  this  si¬ 
tuation,  most  noticeable  with  skilled  performers  or  with 
highly  distinct,  compatible  actions,  the  simultaneous  ac¬ 
tions  must  engage  in  some  process  of  "negotiation"  to 
permit  mutual  performance.  Thus,  if  one  wishes  to  car¬ 
ry  several  objects  at  the  same  time  -  for  example, 
several  pencils,  a  piece  of  paper,  and  a  cup  -  the  normal 
movements  and  positions  of  the  fingers,  hands,  and 
arms  will  be  altered  to  make  the  cooperation  possible 

3  Slips  of  performance,  so  that  the  components  of  one  ac¬ 

tion  sequence  may  get  mixed  up  with  the  components  of 
another,  or  the  memory  or  the  resource  requirements 
for  one  will  interfere  with  the  requirements  for  the  oth¬ 
er,  and  so  on 

4  Non-mdependence  of  action,  so  that  the  performance  of 
one  activity  either  affects  or  causes  the  performance  of 
others,  even  when  these  other  activities  would  appear  to 
be  quite  unrelated  It  is  as  if  there  were  an  overflow 
from  the  activation  of  one  set  of  processing  structures  to 
neighboring  structures,  in  which  the  major  source  of  in¬ 
teraction  results  from  physical  proximity  of  the  process¬ 
ing  structures  rather  than  from  logical  relationships 
among  the  activities  being  performed.  (For  an  interest¬ 


These  different  aspects  of  simultaneous  performance  provide 
hints  as  to  the  nature  of  the  underlying  mechanisms.  I  have  al¬ 
ready  suggested  that  the  doubling  error  in  typing  says  something  of 
the  underlying  representational  structure,  and  of  the  possible 
mechanisms  for  binding  a  function  to  its  arguments.  Slips  provide 
constraints  on  the  nature  of  the  underlying  representational  and 
processing  mechanism.  Examination  of  skilled  typing  provides 
another  source  of  evidence,  requiring  some  mechanism  that  can 
yield  cooperative  behavior  among  the  fingers  and  hands.  Studies  of 
attention  and  of  neurological  deficits  provide  yet  another  source  of 
information. 

In  our  attempt  to  construct  a  processing  model  of  these  as¬ 
pects  of  human  behavior  we  have  been  forced  to  deviate  from  the 
more  traditional  processing  structures,  instead,  we  find  that  a  vi¬ 
able  structure  seems  to  require  multiple,  parallel  units,  all  interact¬ 
ing  with  one  another,  activating  (and  inhibiting)  one  another,  with 
a  tradeoff  between  activation  value  and  the  goodness  to  fit  to  trigger 
conditions.  The  scheme  that  we  propose  is  a  relative  of  production 
systems,  but  the  control  structure  that  we  propose  is  somewhat 
different. 


A.  The  role  of  will  in  the  control  of  action 

We  postulate  that  skilled  action  sequences  are  automatic;  no 
conscious  control  of  them  is  necessary.  However,  because  people 
sometimes  perform  an  action  when  the  conditions  are  not  com¬ 
pletely  satisfactory,  or  hold  back  an  action  even  when  it  would  oth¬ 
erwise  be  appropriate  some  other  form  of  control  is  required.  In 
[10],  we  suggest  that  the  normal  configuration  or  schemas  that  per¬ 
form  an  operation  can  be  thought  of  as  a  horizontal  thread  of  control 
(the  name  taken  from  the  fact  that  the  processing  structure  for 
some  even  sequence  is  often  depicted  as  a  series  of  horizontal  pro¬ 
cessing  stages).  In  normal  circumstances,  the  horizontal  thread 
suffices  to  carry  out  the  action,  with  component  schemas  being  trig¬ 
gered  when  their  activation  values  and  trigger  conditions  are  satis¬ 
factory.  However,  attentional  (conscious)  control  is  necessary 
when  there  is  concern  about  the  adequacy  of  the  horizontal  thread 
structures  (as  in  ill-learned  tasks,  novel  situations,  or  situations  per¬ 
ceived  to  be  dangerous).  This  is  done  through  control  of  the  ac¬ 
tivation  values  of  schemas  by  means  of  vertical  thread  structures. 
The  application  of  attentional  activation  to  bias  the  control  of  the 
horizontal  thread  schemas  we  called  "will."  Thus,  by  the  exertion 
of  will,  one  can  cause  a  schema  to  be  triggered  even  if  it  would  oth¬ 
erwise  not  have  been  or  to  prevent  a  schema  from  being  triggered 
that  would  otherwise  have  been. 

The  application  of  vertical  thread  activation,  will,  is  best  illus¬ 
trated  by  the  situation  where  one  wishes  to  perform  an  undesirable 
act  (such  as  getting  out  of  bed  on  a  cold  morning)  or  to  prevent  a 
desirable  act  (such  as  eating  any  more  of  a  rich  and  tasty  desert). 
In  both  cases  will  is  required,  in  the  former  to  increase  the  activa¬ 
tion  values  sufficiently  to  cause  triggering  of  the  schema  even  in 
the  absence  of  a  sufficiently  good  fit  of  the  triggering  conditions, 
and  in  the  latter  case,  to  prevent  an  activity,  even  though  the  nor¬ 
mal  activation  values  and  triggering  conditions  have  been  met  In 
the  latter  case,  continual  attentional  effort  is  required,  for  if  atten¬ 
tion  lapses,  the  schema  will  revert  to  its  normal  activation  values 
and  triggering  conditions,  and  the  action  will  be  performed 

The  models  of  human  processing  suggested  here  need  not  be 
the  only  candidates.  I  mention  them  because  they  are  suggestive  of 
the  sort  of  processing  structures  required  to  account  for  human  per¬ 
formance.  The  important  point  is  that  conventional  processing 
structures  can  not  describe  human  behavior;  a  new  breed  of  com¬ 
putational  mechanism  must  be  developed. 
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Abatract 


This  paper  uses  the  analysis  of  huaan  error 
to  provide  a  tool  for  the  developaent  of  princi¬ 
ples  of  system  design,  both  to  minimise  the 
occurrence  of  error  and  to  minimise  Its  effects. 
Eventually,  It  should  be  possible  to  establish  a 
systematic  set  of  guidelines,  with  explicit,  quan¬ 
titative  cost-benefit  tradeoffs  that  can  lead 
coward  a  design  discipline  —  a  "Cognitive 
Engineering,"  This  short  note  starts  the  process. 


My  eventual  goal  Is  the  establishment  of  a  discip¬ 
line  of  "Cognitive  Engineering"  that  can  provide 
designers  with  the  tools  required  to  make  their 
products  more  sensitive  and  reaponalva  to  the 
needs  of  the  users.  These  tools  will  have  at  least 
two  components:  first,  a  set  of  well  established 
procedures  and  methods  with  known  benefits  and 
costs,  advantages  and  disadvantages;  second,  a  set 
of  quantitative  modeling  aids  that  can  be  used  to 
give  numerical  assessment  of  the  performance  to  be 
expected  from  a  particular  design  choice.  My  hope 
Is  that  by  providing  a  rationale  based  upon  modern 
cognitive  theory.  It  will  be  possible  to  general¬ 
ise  these  findings  to  new  situations  and  to 
present  then  in  auch  a  way  that  designers  will 
find  them  accessible  and  useable  during  ehs  Che 
course  of  design.  This  paper  Is  simply  the  very 
beginning  of  the  endeavor.  There  are  several  ways 
to  begin.  Let  me  describe  three: 

1.  Start  with  the  psychological  mechanisms  that 
have  been  studied  by  psychologists ;  use 
knowledge  of  the  processing  mechanisms  to 
derive  the  Important  constraints  on  hiaan 
performance.  This  Is  the  approach  taken  by 
Card,  Moran,  and  Unwell  (19S2). 

2.  People  form  mental  models  of  each  other,  the 
world,  and  of  the  devices  and  systems  with 
which  they  interact.  These  mental  models  are 
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used  to  predict  system  behavior  and  guide 
actions.  The  models,  however,  have  interest¬ 
ing  properties,  sometimes  being  derived  from 
Idiosyncratic  Interpretations  of  the  system. 
Moreover,  the  models  must  operate  within  the 
constraints  of  the  human  processing  system  (I 
expand  on  this  In  Norman,  1982).  The  study 
of  these  models,  their  veracity,  and  the 
capability  of  people  to  use  the  models  wisely 
provides  an  important  tool  for  the  under¬ 
standing  of  the  hunan-system  Interface.  This 
la  the  approach  described  In  Mental  Models 
(Centner  A  Stevens,  1982). 


3.  Use  analyses  of  people's  performance  In  a 
variety  of  situations  —  but  especially  their 
errors  —  to  construct  an  analysis  of  the 
appropriate  form  of  hinan-machlne  Interface 
that  would  optimise  performance  and  minimise 
either  the  Incidence  of  error  or  the  effect 
of  the  error,  once  committed. 

All  three  of  these  approaches  are  complementary  eo 
one  another  and  should  be  combined  In  any  complete 
attempt  to  produce  a  cognitive  engineering.  In 
this  brief  paper  I  use  only  the  third  approach. 


Derived  from  the 


I  have  collected  a  number  of  errors  made  by 
people,  both  In  their  everyday  life  and  also  In 
their  use  of  computer  systems  (Norman,  1981). 
These  errors  yield  some  Insight  Into  the  psycho- 
loglcel  mechanisms  that  are  Involved,  but  they  can 
also  be  used  to  examine  the  human-machine  Inter¬ 
face. 


Call  the  highest  level  specification  of  a 
desired  action  an  Intention.  The  Intention  may 
result  from  conscious  decision  making  or  from  sub¬ 
conscious  processing.  The  Important  point  Is  that 
It  la  a  high  level  specification  that  starts  a 
chain  of  processing  that  normally  results  in  the 
accomplishment  of  that  Intention.  An  error  In  the 
Intention  Is  called  a  "mistake.”  An  error  In  car¬ 
rying  out  the  Intention  Is  called  a  "slip.” 

Slips  can  be  classified  Into  a  small  set  of 
classes  based  upon  the  mechanisms  that  seem  the 

most  likely  causes.  The  basic  classification  Is 
based  upon  a  simple  model  of  the  human  In  which  It 
Is  assumed  that  any  Intention  sets  loose  a  number 
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of  active  schemas,  each  vith  an  activation  value 
and  a  set  of  trigger  conditions;  a  schema  la  per¬ 
formed  whenever  the  combination  of  its  activation 
value  and  the  goodness  of  match  of  Its  trigger 
conditions  reaches  an  appropriate  level.  This 
model  gives  rise  to  the  classification  of  slips 
listed  in  Table  1.  For  current  purposes  it  la 
only  necessary  to  examine  a  subset  of  the  classif¬ 
ication  scheme  shown  In  Table  1.  In  particular,  I 
discuss  mode  errors,  description  errors,  capture 
errors,  and  activation  errors. 

Table  1 

(modified  from  Norman,  1981). 

A  Classification  of  Slips 
Based  on  Their  Presumed  Sources 

Slips  In  the  formation  of  intention 

Mode  errors:  erroneous  classification  of  the 
situation 

Description  errors:  ambiguous  or  incomplete 
specification  of  the  Intention 
Slips  resulting  from  faulty  activation  of  schemas 
Unintentional  activation:  when  schemas  not 
part  of  a  current  action  sequence  become 
activated  for  extraneous  reasons,  then 
become  triggered  and  lead  to  slips 
Capture  errors:  when  a  sequence  being  per¬ 
formed  Is  similar  to  another  more  fre¬ 
quent  or  better  learned  sequence,  the 
latter  may  capture  control 
Data-driven  activation:  external  events 

cause  activation  of  schemas 
Associative  activation:  currently  active 

schemas  activate  others  with  which  they 
are  associated 

loss  of  activation:  when  schemas  that  have 
been  activated  lose  activation,  thereby 
losing  effectiveness  to  control  behavior 
Forgetting  an  intention  (but  continuing 
with  the  action  sequence) 

Misordering  the  components  of  an  action 
sequence,  including  skipping  steps 
and  repeating  steps 

Silos  resulting  from  faulty  triggering  of  schemas 
False  triggering:  a  properly  activated  schema 
Is  triggered  at  an  Inappropriate  time 
Spoonerisms:  reversal  of  event  components 
Blends:  combinations  of  components  from  two 
competing  schemas 

Thoughts  leading  to  actions:  triggering  of 
schemas  meant  only  to  be  thought,  not  to 
govern  action 
Premature  triggering 

Failure  In  triggering:  when  an  active  schema 
never  gets  Invoked  because: 

Action  was  preempted  by  competing  schemas; 
There  was  Insufficient  activation,  either  as 
a  result  of  forgetting  or  because  the 
Initial  level  was  too  low; 

There  waa  a  failure  of  the  trigger  condition 
to  match,  either  because  the  triggering 
conditions  were  badly  specified  or  the 
match  between  occurring  conditions  and 
the  required  conditions  were  never  suf¬ 
ficiently  closa. 


Mode  Errors  Suggest  the  Need  for  Better  Feedback 

Mode  errors  occur  when  the  person  believes 
the  system  is  in  one  state  (mode),  whereas  it  la 
actually  in  another.  This  leads  to  the  perfor¬ 
mance  of  an  Inappropriate  action.  Mode  errors 
occur  frequently  In  systems  that  do  not  provide 
clear  feedback  as  to  their  current  state.  The 
moat  common  examples  in  my  collection  come  from 
the  use  of  computer  text  editors,  where  users  try 
to  Issue  commands  while  In  text  mode  or  to  type 
text  while  In  command  mode.  Similar  errors  occur 
In  pushing  the  buttons  on  complex  digital  watches. 
The  autopilots  of  commercial  aircraft  provide 
numerous  possibilities  for  mode  errors;  a  recent 
Incident  In  which  an  Aero  Mexico  DC-10  stalled, 
was  badly  buffeted,  and  lost  the  tips  of  both 
elevators  appears  to  have  been  the  result  of  a 
mode  error  in  using  the  autopilot  on  the  part  of 
the  crew  (KTSB,  1980a).  The  clear  Implication  of 
mode  errors  Is  that  they  result  from  Inadequate 
feedback  and  Indication  of  the  state  of  the  sys¬ 
tem. 

Description  Errors  Suggest  the  Need  for  Better 
System  Configuration 

A  description  error  occurs  when  there  Is 
Insufficient  specification  of  the  action,  and  the 
resultant  ambiguity  leads  to  an  erroneous  act 
being  performed.  Usually  this  erroneous  act  Is 
closely  related  to  the  desired  one.  Often  the 
errors  are  humorous  (at  least  to  others).  One 
dramatic  case  in  my  collection  occurred  when  a 
person,  while  cleaning  a  fish  In  a  rowboat  in  the 
middle  of  a  lake,  threw  the  cleaned  fish  overboard 
and  kept  the  entrails.  In  another  related  case,  a 
person  preparing  for  a  party  put  the  cake  In  the 
refrigerator  and  the  salad  in  the  oven.  Descrip¬ 
tion  errors  also  occur  In  operational  situations, 
where  they  can  lead  to  serious  accidents.  The  two 
preceding  description  errors  can  be  thought  of  as 
situations  in  which  the  proper  arguments  and  func¬ 
tions  were  specified,  but  the  ordering  of  the 
arguments  was  Improper.  In  general,  these  errors 
occur  when  different  actions  have  similar  descrip¬ 
tions,  either  In  the  specification  of  the  actions 
or  In  the  class  of  arguments. 

One  class  of  description  errors  occurs  In  the 
use  of  computer  text  editors  which  have  multiple 
commands,  usually  based  upon  one  or  two  keys¬ 
trokes.  Thus,  in  the  text  editor  "vl”  (the  screen 
editor  supplied  with  the  Berkeley  Distribution  of 
the  UNIX  operating  system) ,  each  of  the  letters  cl, 
f_,  £,  and  u,  has  different  meanings  when  typed  In 
Tower  case  ("d"),  upper  case  ("shift-d"  or  "D"), 
or  as  a  control  key  ("control-d").  Many  other 
keys  also  have  these  multiple  uses.  It  should 
come  as  no  surprise  to  discover  that  description 
errors  occur  frequently  In  this  editor. 

Description  errors  are  relatively  common  In 
the  throwing  of  switches  or  operations  of  con¬ 
trols,  especially  when  the  operations  are  similar, 
such  as  In  the  setting  of  altimeters,  radio  fre¬ 
quencies,  and  transponder  codes.  This  problem  Is 


•specially  bad  la  the  design  of  nuclear  power 
plant  control  rooms,  where  switches  and  controls 
ere  laid  out  In  neat,  logical,  nice  looking  rows. 
The  result,  however,  Is  clear  potential  for  confu¬ 
sion,  for  reading  the  wrong  lnstruaenta  and  for 
operating  the  wrong  controls  (Lockheed  Missiles  & 
Space  Company,  1976), 

Description  errors  can  be  expected  to  occur 
wherever  control  panels  are  designed  so  that  at  a 
quick  glance  (or  In  peripheral  vision)  the  dis¬ 
tinctions  among  controls  are  not  clear  enough. 
Solutions  to  this  problem  have  long  been  known. 
Three  principles  are  as  follows: 

1,  Arrange  Instruments  and  controls  In  func¬ 
tional  patterns,  perhaps  In  the  form  of  a 
flow  chart  of  the  system; 

2,  Use  "shape  coding"  to  make  the  controls  and 
Instruments  look  and  feel  different  f.r^m  <ase 
another; 

3,  Make  It  difficult  to  do  actions  thf<r  can  lead 
to  operations  that  have  serious  1*- (Heat? ’ns 
and  that  are  not  reversible. 

With  computer  systems,  these  threw  ace 

readily  modified  to  their  Computer''  (”t“)  ver¬ 
sions: 

1C.  Screen  displays  and  menu  ays  tea.’  should  be 
organized  functionally; 

2C.  Design  the  command  language  (or  menu  display 
headings)  to  be  distinct  from  one  another  so 
as  not  to  be  easily  confused,  either  In  per¬ 
ception  or  in  the  action  required; 

3C.  Make  it  difficult  to  do  actions  that  can  lead 
to  operations  with  serious  Implications  and 
that  are  not  reversible 


Lack  of  consistency  In  command  structure 
leads  to  description  errors .  One  class  of 
description  errors  occurs  when  a  person  attempts 
to  re-dertve  an  action  sequence  and  does  so 
Improperly,  forming  a  sequence  appropriate  for  an 
action  different  from  the  one  Intended.  This 
occurs  primarily  through  a  lack  of  consistency  in 
command  structure,  sc  that  the  appropriate  struc¬ 
ture  for  one  command  Is  not  the  same  for  another, 
even  though  the  conaands  appear  to  be  related  and 
share  a  common  description  of  purpose,  action,  and 
even  part  of  the  command  format.  Similar  altua- 
tlons  occur  In  the  Interpretation  of  lnstrwent 
readings.  The  basic  concept  Involved  here  Is  that 
when  people  lack  knowledge  about  the  proper  opera¬ 
tion  of  some  aspect  of  a  machine,  they  are  apt  to 
derive  the  operation  by  analogy  with  other,  simi¬ 
lar  aspects  of  the  device.  The  "derivation"  may 
be  unconscious,  and  It  can  Influence  behavior 
without  tha  person  realizing  that  It  Is  happening. 
Forming  conclusions  from  the  relationships  of  one 
system  to  another  Is  a  common  and  powerful  method 
of  human  thought,  but  It  can  lead  to  error  If  the 
mapping  from  one  domain  onto  the  other  Is  not  con¬ 
sistent  (Lakoff  A  Johnson,  1981;  Centner,  1980). 


There  are  cases  where  lack  of  conalatency 
seems  desirable,  and  It  Is  put  Into  the  design 
deliberately  and  with  careful  thought.  This  usu¬ 
ally  occurs  when  the  normal  sequence  for  an  opera¬ 
tion  is  long  and  tedious,  and  when  such  an  opera¬ 
tion  la  to  be  performed  frequently  It  aeems 
desirable  to  provide  shortcuts.  Similarly,  the 
default  state  of  an  Instrwent  or  control  Is  some¬ 
times  made  lnconsletent  with  that  of  other  Instru¬ 
ments  or  controls  because  experience  shows  that 
the  different  defaults  simplify  some  forma  of 
operations.  .Nonetheless,  these  Inconsistencies 
lead  to  errors  (and  to  difficulty  In  learning). 
One  solution  Is  to  make  command  structure  (and 
instriment  format)  consistent,  even  at  the  cost  of 
some  Inefficiency  is  usage.  A  better  solution 
would  be  to  re-deslgn  the  entire  system  so  as  to 
yield  both  consistency  and  ease  of  operation. 

Capture  Errors  Imply  the  Meed  for  Better  Feedback 

A  capture  error  occurs  when  there  Is  overlap 
In  the  sequence  required  for  the  performance  of 
two  different  actions,  especially  when  one  Is  done 
considerably  more  frequently  than  the  other.  In 
the  course  of  attempting  the  infrequent  one,  the 
more  coaon  act  gets  done  Instead.  A  capture  error 
with  the  "vl"  text  editor  on  the  Berkeley  Release 
of  the  DNIX  operating  system  occurs  when  attempt¬ 
ing  to  write  out  a  file.  The  command  ":w"  means 
to  write  the  file,  ":q"  quits  the  editor  (if  the 
text  has  not  been  modified  since  the  last  writing 
of  the  file)  and  the  combined  sequence  ":wq” 
writes,  then  quits.  Because  ”:wq"  Is  such  a  con¬ 
venient  operation,  many  people  use  It  regularly  as 
their  way  of  finishing  a  day's  session,  and  so  It 
soon  becomes  an  automatic  conund,  with  the  status 
of  a  single  operation  rather  than  of  two  sequen¬ 
tially  combined  commands.  However,  as  a  result, 
at  times  when  one  wishes  simply  to  w-lte  the  file 
and  continue  with  the  editing,  one  finds  oneself 
out  of  the  editor  and  back  In  the  operating  sys¬ 
tem:  by  a  capture  error,  the  sequence  ":wq"  vas 
typed  Instead  of  the  simpler  sequence  ":w". 

One  possible  way  of  avoiding  this  class  of 
error  is  to  minimize  overlapping  sequences,  but 
this  may  not  be  possible,  especially  when  the 
Infrequent  action  sequence  Is  simply  a  modifica¬ 
tion  of  the  frequent  one.  In  the  case  of  "vl"  If 
":wq"  were  taken  over  by  some  other  command  (e.g.. 
In  never  versions  of  the  system,  "ZZ"  Is 
equivalent  to  ":vq")  the  capture  error  should 
disappear,  as  the  two  different  commands  —  ":v" 
and  "ZZ"  have  no  parts  in  common. 

A  second  way  of  avoiding  the  error  Is  to  try 
to  catch  It  where  it  occurs.  The  error  occurs  at 
the  critical  place  where  the  sequences  deviate,  so 
It  Is  here  that  the  problem  must  be  faced.  If  the 
system  knovs  what  the  intention  of  the  user  is 
(perhaps  by  requiring  the  user  to  Indicate  the 
overall  Intention) ,  It  could  be  designed  so  that 
at  the  critical  choice  point  the  proper  path  was 
flagged  or  In  some  other  way  brought  to  the  atten¬ 
tion  of  the  operator.  In  addition,  sufficient 
feedback  about  the  state  of  the  system  should  be 
provided  to  provide  reminders  as  to  the  deviation 
from  the  Intention.  A  major  Issue  here  Is  simply 


to  know  the  critical  place  at  which  the  errors 
occur  ao  that  remedial  action  can  be  built  Into 
the  system  at  that  critical  point* 


Activation  Issues  Sueeest  the  Importance  of 
Displaying  the  Potions  and  of  Providing  Feedback 

Activation  errors  are  of  two  classea;  Inap¬ 
propriate  actions  get  performed  and  appropriate 
actions  fall  to  get  done.  The  foraer  occurs  when 
an  Inappropriate  action  sequence  Is  activated 
either  by  being  related  to  desired  sequences  (as 
In  the  capture  error)  or  through  events  In  the 
world  ("data-driven  activation").  The  failure  to 
carry  out  an  action  usually  occurs  due  to  aeaory 
failure,  and  this  can  occur  when  events  Intercede 
between  the  time  of  preparing  an  Intention  and  the 
' lme  at  which  the  act  should  be  perforaed.  Various 
memory  aids  seem  essential  to  prevent  the  latter. 
The  first  form  of  activation  error  may  very  well 
not  be  preventable.  In  this  case,  the  systea 
should  be  designed  to  be  tolerant  of  them. 

People  Will  Make  Errors.  So  Make  the  System  Insen¬ 
sitive  to  Them 

The  analysis  of  errors  provides  one  act  of 
considerations  for  the  construction  of  a  system 
that  might  minimize  errors.  There  are  aeveral 
other  factors  that  should  be  considered  as  well. 
First,  people  will  make  errors,  even  In  the  best 
designed  systems,  even  with  the  best  of  training 
and  best  of  motivations.  So,  a  corollary  of  tha 
attempt  to  minimize  errors  Is  that  one  should  try 
to  minimize  the  effect  of  an  error.  This  means 
that  actions  should  be  reversible,  at  least  as 
much  as  Is  possible.  Some  things,  of  course,  once 
performed,  are  Irrevocable.  Actions  that  can  lead 
to  difficulty  should  be  difficult  to  do,  perhaps 
requiring  a  set  of  steps  (as  In  the  release  of 
"safeties"  required  when  the  pilot  wishes  to  eject 
from  a  military  airplane),  or  at  least,  requiring 
a  confirmation,  as  when  requesting  that  all  files 
on  a  computer  directory  be  destroyed. 

It  is  not  sufficient  to  ask  the  user  to  con¬ 
firm  that  a  particular  action  sequence  Is  wanted, 
because  If  confirmation  Is  routinely  asked  for 
(and  if  the  usual  response  Is  "yes")  the  confirma¬ 
tion  Itself  becomes  an  automatically  Invoked  com¬ 
ponent  of  the  command  sequence.  Thus,  If  the 
command  Is  given  In  error.  It  Is  likely  to  hsve 
the  confirmation  Invoked  as  part  of  the  same 
error;  In  our  experience,  the  confirmation  Is  as 
apt  to  be  In  error  as  the  original  consand.  The 
point  Is  that  dlaastrous  commands  should  be  diffi¬ 
cult  to  carry  out,  and  confirmations  of  the  vsll- 
dlty  of  the  command  may  not  offer  sufficient  dif¬ 
ficulty  to  be  a  satisfactory  aafeguard. 

Sometimes  the  command  naad  only  act  as  if  It 
were  done,  but  does  not  in  fact  have  to  be  done. 
Conalder  the  command  to  deleta  fllea  from  tha  sys¬ 
tem;  the  system  could  claim  to  have  removed  the 
file,  but  In  fact  put  them  away  on  some  temporary 
location  so  that  they  can  be  recovered  If  later 
their  "deletion"  was  discovered  to  have  been  an 
error  (real  deletion  can  be  done  on  an  Infrequent 
b  ils,  say  after  a  lapse  of  several  hours  or 


basis,  say  after  a  lapse  of  several  hours  or 
days).  In  Interllap  (Teltelman  t  Maslnter,  1981) 
operations  nay  be  "undone,"  even  operations  such 
as  writing  on  or  destroying  files. 


Lessons 

These  simple  observations  lead  us  to  some 
conclusions  about  system  design.  Obviously,  this 
analysis  only  takes  us  part  of  the  way  toward  a 
.set  of  design  principles.  An  analysis  of  errors 
can  only  get  at  some  classes  of  problems,  and 
there  may  not  always  be  general  rules  applicable 
to  the  issues.  These  analyses  must  be  supple¬ 
mented  with  other  methods.  Including  an  under¬ 
standing  of  the  nature  of  a  person's  mental  image 
of  the  system  that  la  being  used  and  an  under¬ 
standing  of  the  human  Information  processing  capa¬ 
bility  of  the  user.  Meanwhile,  the  analyses 
presented  here  do  make  several  points  that  are 
useful  to  suasMrlze: 

*  Feedback:  The  state  of  the  system  should  be 
clearly  available  to  the  user.  Ideally  In  a 
form  that  Is  unambiguous  and  that  makes  the 
set  of  options  readily  available  so  as  to 
avoid  mode  errors. 

*  Similarity  of  response  sequences:  Different 
classes  of  actions  should  have  quite  dissimi¬ 
lar  command  sequences  (or  menu  patterns)  so 
as  to  avoid  capture  and  description  errors. 

*  Actions  should  be  reversible  (as  much  as  pos¬ 
sible)  and  where  both  Irreversible  and  of 
relatively  high  consequence,  they  should  be 
difficult  to  do,  thereby  preventing  uninten¬ 
tional  performance. 

*  Consistency  of  the  system:  The  system  should 
be  consistent  In  Its  structure  and  design  of 
command  so  as  to  minimize  memory  problems  In 
retrieving  the  operations. 


These  considerations,  coupled  with  similar 
analyses  of  the  properties  of  the  users'  mental 
models  of  the  system  lead  to  other  sets  of  rules 
for  performance.  Including  the  notion  of  e  system 
image,  which  should  be  the  first  thing  set  up  by 
the  designer,  and  with  all  commands,  feedback,  and 
Instruction  designed  to  be  consistent  with  that 
system  Image.  However,  this  Is  another  story,  one 
that  too  Is  but  In  the  early  stages  of  develop¬ 
ment,  and  which  Is  not  fully  ready  to  be  discussed 
here. 
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THE  TROUBLE 
WITH  UNIX 

by  Donald  A.  Norman 

UNIX  is  a  highly  fouled  operating  system.  De¬ 
veloped  at  the  Bell  Telephone  Laboratories 
and  distributed  by  Western  Electric,  it  has 
become  a  standard  operating  system  in  uni¬ 
versities.  and  it  promises  to  become  a  stan¬ 
dard  for  micro  and  mini  systems  in  homes, 
small  businesses,  and  schools.  But  for  all  of 
its  virtues  as  a  system — and  it  is  indeed  an 
elegant  system — UNIX  is  a  disaster  for  the 
casual  user.  It  fails  both  on  the  scientific  prin¬ 
ciples  of  human  engineering  and  even  in  just 
plain  common  sense. 

If  Unix  is  really  to  become  a  general 
system,  then  it  has  got  to  be  fixed  I  urge 
correction  to  make  the  elegance  of  the  system 
design  be  reflected  as  friendliness  towards  the 
user,  especially  the  casual  user  Although  I 
have  learned  to  get  along  with  the  vagaries  of 
Unix's  user  interface,  our  secretarial  staff  per¬ 
sists  only  because  we  insist. 

And  even  I.  a  heavy  user  of  computer 
systems  for  20  years,  have  had  difficulties, 
copying  the  old  file  over  the  new  .  transferring 
a  file  into  itself  until  the  system  collapsed, 
and  removing  all  the  files  from  a  directory 
simply  because  an  extra  space  was  typed  in 
the  argument  string  The  problem  is  that  Unix 
fails  several  simple  tests 

Consistent  v  Command  names,  lan¬ 
guage.  functions,  and  syntax  are  inconsistent 
hum  tionulits  The  command  names, 
formats,  and  syntax  seem  to  have  no  relation¬ 
ship  to  their  functions 

Friendliness  Unix  is  a  recluse,  hid¬ 
den  from  the  user,  silent  in  operation  The 
lack  of  interaction  makes  it  hard  to  tell  what 
state  the  system  is  in.  and  the  absence  of 
mnemonic  structures  puts  a  burden  on  the 
£  user's  memory 

What  is  good  about  Unix  ’The  system 
a  design,  the  generality  of  programs,  the  file 
'  structure,  the  |ob  structure,  the  powerful  op- 
i  crating  system  command  language  l the 
"shell  "I  Too  bad  the  concern  for  system 
■  :  design  was  not  matched  by  an  equal  concern 
for  the  human  interface 

;.  One  of  the  first  things  you  learn  when 

?  you  start  to  decipher  i  nix  is  how  to  list  the 
contents  of  a  file  onto  your  terminal  Now  this 
:  sounds  straight  forward  enough,  but  in  i  nix 
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WHAT  IS  UNIX? 

UNIX  is  an  operating  system  developed  by 
Dennis  Ritchie  and  Ken  Thompson  of  Bell 
Laboratories.  Unix  is  trademarked  by  Bell 
Labs  and  is  available  under  license  from 
Western  Electric.  Although  Unix  is  a  rela¬ 
tively  small  operating  system,  it  is  quite 
powerful  and  general .  It  has  found  consider¬ 
able  favor  among  programming  groups,  es¬ 
pecially  in  universities,  where  it  is  primarily 
used  with  DEC  computers — various  versions 
of  the  dec  pdp-  1 1  and  the  vax  The  operat¬ 
ing  system  and  its  software  are  written  in  a 
high  level  programming  language  called  C, 
and  most  of  the  source  code  and  documenta¬ 
tion  is  available  on-line.  For  programmers. 
Unix  is  easy  to  understand  and  to  modify. 

For  the  nonexpeit  programmer,  the 
important  aspect  of  UNIX  is  that  it  is  con¬ 
structed  out  of  a  small .  basic  set  of  concepts 
and  programming  modules,  with  a  flexible 
method  for  interconnecting  existing  mod¬ 
ules  to  make  new  functions.  All  system  ob¬ 
jects — including  all  t/o  channels — look  like 
files.  Thus,  it  is  possible  to  cause  input  and 
output  for  almost  any  program  to  be  taken 
from  or  to  go  to  files,  terminals,  or  other 
devices,  at  any  time,  without  any  particular 
planning  on  the  pan  of  the  module  writer. 
UNIX  has  a  hierarchical  file  structure.  Users 
can  add  and  delete  file  directories  at  will  and 
then  “position"  themselves  at  different  lo¬ 
cations  in  the  resulting  hierarchy  to  make  it 
easy  to  manipulate  the  files  in  the  neighbor¬ 
hood. 

The  command  interpreter  of  the  op¬ 
erating  system  interface  (called  the 
“shell")  can  take  its  input  from  a  file, 
which  means  that  it  is  possible  to  put  fre¬ 
quently  used  sequences  of  commands  into  a 
file  and  then  invoke  that  file  'just  by  typing 
its  name),  thereby  executing  the  command 
strings.  In  this  way,  the  user  can  extend  the 
range  of  commands  that  are  readily  availa¬ 
ble.  Many  users  end  up  with  a  large  set  of 
specialized  shell  command  files.  Because 
the  shell  includes  facilities  for  passing  argu¬ 
ments,  for  iterations,  and  for  conditional 
operations,  these  "shell  programs"  can  do 
quite  a  lot,  essentially  calling  upon  all  sys¬ 
tem  resources  ( including  the  editors)  as  sub¬ 
routines.  Many  nonprogrammers  have  dis¬ 
covered  that  they  can  write  powerful  shell 


programs,  thus  significantly  enhancing  the 
power  of  the  overall  system. 

By  means  of  a  communication  chan¬ 
nel  known  as  a  pipe,  the  output  from  one 
program  can  easily  be  directed  (piped)  to  the 
input  of  another,  allowing  a  sequence  of 
programming  modules  to  be  strung  together 
to  do  some  task  that  in  other  systems  would 
have  to  be  done  by  a  special  purpose  pro¬ 
gram.  UNIX  does  not  provide  special  pur¬ 
pose  programs.  Instead,  it  attempts  to  pro¬ 
vide  a  set  of  basic  software  tools  that  can  be 
strung  together  in  flexible  ways  using  l  o 
redirection,  pipes,  and  shell  programs. 
Technically,  Unix  is  just  the  operating  sys¬ 
tem.  However,  because  of  the  way  the  sys¬ 
tem  has  been  packaged,  many  people  use 
the  name  to  include  all  of  the  programs  that 
come  on  the  distribution  tape.  Many  people 
have  found  it  easy  to  modify  the  UNIX  sys¬ 
tem  and  have  done  so,  which  has  resulted  in 
hordes  of  variations  on  various  kinds  of 
computers.  The  "standard  UNIX"  discussed 
in  the  article  is  BTL  Unix  Version  6  (May 
1975).  The  Fourth  Berkeley  Edition  of  Unix 
is  more  or  less  derived  from  BTL  UNIX  Ver¬ 
sion  7  (September  1978),  with  considerable 
parallel  development  at  the  University  of 
California,  Berkeley  and  some  input  from 
other  BTL  UNIX  versions.  I  am  told  that  some 
of  the  complaints  in  the  article  have  been 
fixed;  however.  Version  6  is  still  used  by 
many  people. 

The  accompanying  article  is  written 
with  heavy  hand,  and  it  may  be  difficult  to 
discern  that  I  am  a  friend  of  UNIX  The  nega¬ 
tive  tone  should  not  obscure  the  beauty  and 
power  of  the  operating  system,  file  struc¬ 
ture,  and  the  shell.  UNIX  is  indeed  a  superior 
operating  system.  1  would  not  use  any  other. 
Some  of  the  difficulties  detailed  result  from 
the  fact  that  many  of  the  system  modules 
were  written  by  the  early  users  of  Unix,  not 
by  the  system  designers;  a  lot  of  individual 
idiosyncrasies  have  gotten  into  the  system. 
It  is  my  hope  that  the  positive  aspects  of  the 
article  will  not  be  overlooked.  They  can  be 
used  by  all  system  designers,  not  just  by 
those  working  on  Unix.  Some  other  systems 
need  these  comments  a  lot  more  than  does 
UNIX 
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even  this  simple  operation  has  its  drawbacks 
Suppose  I  have  a  file  called  "testfile."  I  want 
to  see  what  is  inside  of  it.  How  would  you 
design  a  system  to  do  it?  I  would  have  written 
a  program  that  listed  the  contents  onto  the 
terminal,  perhaps  stopping  every  24  lines  if 
you  had  signified  that  you  were  on  a  display 
terminal  with  only  a  24-line  display  UNIX, 
however,  has  no  basic  listing  command,  and 
instead  uses  a  program  meant  to  do  something 
else 

Thus  if  you  want  to  list  the  contents  of 
a  file  called  "Happy  Days."  you  use  the  com¬ 
mand  named  "cat": 

cat  HappyDays 

Why  cal  ’  Why  not?  After  all.  as  Humpty 
Dumpty  said  to  Alice,  who  is  to  he  the  boss. 


words  or  us?  "Cat."  short  for  "concatenate" 
as  in.  take  file  1  and  concatenate  it  with  file2 
(yielding  one  file,  with  the  first  part  filel .  the 
second  file 2)  and  put  the  result  on  the  "stan¬ 
dard  output"  (which  is  usually  the  terminal): 
cat  filel  file2 

Obvious,  right?  And  if  you  have  only  one  file, 
why  cat  will  pul  it  on  the  standard  output — the 
terminal— and  that  accomplishes  the  goal 
(except  for  those  of  us  with  video  terminals, 
who  watch  helplessly  as  the  text  goes  stream 
mg  off  the  display) 

The  (  NIX  designers  believe  in  the 
principle  that  special  purpose  functions  can 
be  avoided  by  clever  use  ol  a  small  set  of 
system  primitives  Why  make  a  special  func 
lion  when  the  side  effects  of  other  functions 


will  do  what  you  want?  Well,  for  several 
reasons: 

•  Meaningful  terms  are  considerably  easier 
to  learn  than  nonmeaningful  ones  In  comput¬ 
er  systems,  this  means  that  names  should  re¬ 
flect  function,  else  the  names  for  the  function 
will  be  difficult  to  recall. 

•  Making  use  of  the  side  effects  of  sy  stem 
primitives  can  be  risky.  If  cat  is  used  unwise 
ly.  it  will  destroy  files  (more  on  this  in  a 
moment). 

•  Special  functions  can  do  nice  things  for 
users,  such  as  stop  at  the  end  of  screens,  or  pul 
on  page  headings,  or  transform  nonprinting 
characters  into  printing  ones,  or  get  rid  of 
underlines  for  terminals  that  can't  do  that. 
Cat,  of  course,  won't  stop  at  terminal  or  page 
boundaries,  because  doing  so  would  disrupt 
the  concatenation  feature.  But  still,  isn't  it 
elegant  to  use  cat  for  listing'’  Who  needs  a 
print  or  a  list  command?  You  mean  "cat" 
isn't  how  you  would  abbreviate  concatenate? 
It  seems  so  obvious,  just  like: 


FUNCTION 

UNIX  COMMAND  N  AMI 

c  compiler 

cc 

change  working 

directory 

chdir 

change  password 

passwd 

concatenate 

cat 

copy 

cp 

date 

date 

echo 

echo 

editor 

ed 

link 

In 

move 

mv 

remove 

rm 

search  file  for 

pattern 

grep 

Notice  the  lack  of  consistency  in  forming  the 
command  name  from  the  function  Some 
names  are  formed  by  using  (he  first  two  con 
sonants  of  the  function  name  Editor,  how  ex 
er.  is  "ed,"  concatenate  is  "cat.  "  and 
"date"  and  "echo"  are  not  abbreviated  at 
all  Note  how  useful  those  two- letter  abbre 
viations  are  They  save  almost  400  millisec¬ 
onds  per  command 

Similar  problems  exist  with  the  name' 
of  the  file  directories  UNIX  is  a  file-onenled 
system,  with  hierarchical  directory  siruc 
lures,  so  the  directory  names  are  very  impoi 
tant  Thus .  this  paper  is  being  w  ruten  on  a  fi  le 
named  "Unix"  and  whose  "path"  is  csl 
norman  papers  CogEnginecnng  umx  The 
name  of  the  top  directory  is  "  ",  and  csl. 
norman.  papers,  and  C'ogEngineenng  are  the 
names  of  directories  hierarchically  placed  be¬ 
neath  "  "  Note  that  the  sy  mbol  "  "  has  iw  o 
meanings  the  name  of  the  lop  level  directory 
and  the  symbol  that  separates  levels  of  the 
directories  This  is  very  difficult  to  |u\tify  to 
new  users  And  those  names  he  directory  for 
"users"  and  "mount"  are  called,  of  course. 
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After  all,  as  Humpty  Dumpty  said  to  Alice,  who  is 
to  be  the  boss,  words  or  us? 


"usr"  and  "mm."  And  (here  are  "bin," 
"lib,"  and  "tmp"  (binary,  library,  and 
(emp).  (.’Nix  loves  abbreviations,  even  when 
the  original  name  is  already  very  short.  To 
write  "user"  as  "usr"  or  "temp"  as  "tmp" 
saves  an  entire  letter:  a  letter  a  day  must  keep 
the  service  person  away  But  Unix  is  inconsis¬ 
tent:  it  keeps  "grep  "  at  its  full  four  letters, 
when  it  could  have  been  abbreviated  as  "gr" 
or  "gp."  (What  does  grep  mean?  "Global 
Rlgular  expression.  Print" — at  least  that's 
the  best  we  can  invent;  the  manual  doesn't 
even  try.  The  name  wouldn't  matter  if  grep 
were  something  obscure,  hardly  ever  used, 
but  in  fact  it  is  one  of  the  more  powerful . 
frequently  used  string  processing  com¬ 
mands  ) 


LIKE  CAT?  Another  important  routine 

goes  by  the  name  of 
TRY  ncu/  "dsw Suppose  you  acci- 

Inl  UOW  dentally  create  a  file  whose 

name  has  a  nonprinting  character  in  it.  How 
can  you  remove  it?  The  command  that  lists  the 
files  on  your  directory  won't  show  ncwinting 
characters.  And  if  the  character  is  a  sp„.  -  (or 
worse,  a  "*"),  "rm"  (the  program  that  re¬ 
moves  files)  won't  accept  it .  The  name  •  'dsw" 
w  as  evidently  written  by  someone  at  Bell  Labs 
who  felt  frustrated  by  this  problem  and  hacked 
up  a  quick  solution.  Dsw  goes  to  each  file  in 
your  directory  and  asks  you  to  respond  “yes" 
or  "no."  whether  to  delete  the  file  or  keep  it. 

How  do  you  remember  dsw?  What  on 
earth  does  the  name  stand  for?  The  UNIX  peo¬ 
ple  won't  tell:  the  manual  smiles  the  wry 
smile  of  the  professional  programmer  and 
says.  "The  name  dsw  is  a  carryover  from  the 
ancient  past.  Its  e.ymology  is  amusing." 
Which  operation  takes  place  if  you  say 
"yes"?  Why,  the  file  is  deleted  of  course.  So 
if  you  go  through  your  files  and  see  impor¬ 
tant-file.  you  nod  to  yourself  and  say,  yes,  I 
had  better  keep  that  one.  You  type  in  "yes.” 
and  destroy  it  forever.  There's  no  warning; 
dsw  doesn't  even  document  itself  when  it 
starts,  to  remind  you  of  which  way  is  which. 
Berkeley  UNIX  has  finally  killed  dsw.  saying 
"This  little  known,  but  indispensable  facility 
has  been  taken  over  ..."  That  is  a  fitting 
commentary  on  standard  UNIX:  a  system  that 
allows  an  "indispensable  facility"  to  be  "lit¬ 
tle  known." 

The  symbol  means  "glob"  (a 
typical  UNIX  name:  the  name  tells  you  just 
what  it  does,  right?).  Let  me  illustrate  with 
our  friend,  "cat."  Suppose  I  want  to  collect  a 
set  of  files  named  paper.  I  paper. 2  paper. 3 
and  paper. 4  into  one  file.  I  can  do  this  with 
cat: 

cat  paper.  I  paper. 2  paper. 3  paper. 4> 
newfilename 

UNIX  provides  "glob"  to  make  the  job  even 
easier.  Glob  means  to  expand  the  filename  by 
examining  all  files  in  the  directory  to  find  all 


that  fit.  Thus,  I  can  redo  my  command  as 
cat  paper* >newfilename 
where  paper*  expands  to  {paper  !  paper.2 
paper  3  paper. 4}.  This  is  one  of  the  typical 
virtues  of  Unix:  there  are  a  number  of  quite 
helpful  functions.  But  suppose  I  had  decided 
to  name  this  new  file  "paper. all" — pretty 
logical  name. 

cat  paper* >paper. all 

Disaster.  In  this  case,  paper*  expands  to  pa¬ 
per.  1  paper.2  paper. 3  paper. 4  paper. all,  and 
so  I  am  filling  up  a  file  from  itself: 
cal  paper.  1  paper.2  paper. 3  paper. 4 
paper. all>paper. all 

Eventually  the  file  will  burst.  Does  UNIX 
check  against  this,  or  at  least  give  a  warning? 
No  such  luck.  The  manual  doesn't  alert  users 
to  this  either,  although  it  does  warn  of  anoth¬ 
er.  related  infelicity:  "Beware  of ‘cat  a  b  >  a' 
and  ‘cat  b  a  >  a',  which  destroy  the  input  files 
before  reading  them.”  Nice  of  them  to  tell  us. 

The  command  to  remove  all  files  that 
start  with  the  word  "paper" 
rm  paper* 

becomes  a  disaster  if  a  space  gets  inserted  by 
accident: 

rm  paper  * 

for  now  the  file  "paper"  is  removed,  as  well 
as  every  file  in  the  entire  directory  (the  power 
of  glob).  Why  is  there  not  a  check  against 
such  things?  I  finally  had  to  alter  my  version 
of  rm  so  that  when  I  said  to  remove  files,  they 
were  moved  to  a  special  directory  named 
"deleted"  and  preserved  there  until  I  logged 
off,  leaving  me  lots  of  time  for  second 
thoughts  and  catching  errors.  This  illustrates 
the  power  of  UNIX:  what  other  operating  sys¬ 
tem  would  make  it  so  easy  for  someone  to 
completely  change  the  operation  of  a  system 
command?  It  also  illustrates  the  trouble  with 
Unix:  what  other  operating  system  would 
make  it  so  necessary  to  do  so?  (This  is  no 
longer  necessary  now  that  we  use  Berkeley 
Unix — more  on  this  in  a  moment.) 


THE  SHY  The  standard  text  editor  is 
called  Ed.  I  spent  a  year 
„  using  it  as  an  experimental 

CUllUn  vehicle  to  see  how  people 

deal  with  such  confusing  things.  Ed's  major 
property  is  his  shyness;  he  doesn't  like  lo  talk . 
You  invoke  Ed  by  saying,  reasonably 
enough,  "ed."  The  resuli  is  silence;  no  re- 
sponse.  no  prompt,  no  message,  just  silence. 
Novices  are  never  sure  what  that  silence 
means.  Ed  would  be  a  bit  more  likable  if  he 
answered,  "thank  you.  here  I  am."  or  at  least 
produced  a  prompt  character,  but  in  (MX 
silence  is  golden.  No  response  means  that 
everything  is  okay;  if  something  had  gone 
wrong,  it  would  have  told  you 

Then  there  is  the  famous  append  mode 
error.  To  add  text  into  the  buffer,  you  have  to 
enter  "append  mode."  To  do  this,  you  sim¬ 
ply  type  "a.”  followed  by  return.  Now 


everything  that  is  typed  on  the  terminal  goes 
into  the  buffer.  (Ed,  true  to  form,  does  not 
inform  you  that  it  is  now  in  append  mode, 
when  you  type  “a"  followed  by  "kkturn" 
the  result  is  silence.)  When  you  arc  finished 
adding  text,  you  are  supposed  to  type  a  line 
that  "contains  only  a  .  on  it  "  This  gets  you 
out  of  append  mode. 

Want  to  bet  on  how  many  extra  pen 
ods  got  inserted  into  text  files,  or  how  many 
commands  got  inserted  into  texts,  because  the 
users  thought  that  they  were  in  command 
mode  and  forgot  that  they  had  not  left  append 
mode?  Does  Ed  tell  you  when  you  have  left 
append  mode?  Hah!  This  problem  is  so  obvi¬ 
ous  that  even  the  designers  recognized  it.  but 
their  reaction,  in  the  tutorial  introduction  ti 
Ed.  was  merely  to  note  wryly  that  even  expe 
rienced  programmers  make  this  mistake 
While  they  may  be  able  to  see  humor  in  the 
problem,  it  is  devastating  to  the  beginning 
secretary,  research  assistant  or  student  trying 
to  use  UNIX  as  a  word  processor,  an  experi¬ 
mental  tool,  or  just  to  learn  about  computers. 

How  good  is  your  sense  of  humor? 
Suppose  you  have  been  working  on  a  file  for 
an  hour  and  then  decide  to  quit  work,  exiting 
Ed  by  saying  “q."  The  problem  is  that  Ed 
would  promptly  quit.  Woof,  there  went  your 
last  hour's  work.  Gone  forever.  Why.  if  you 
had  wanted  to  save  it  you  would  have  said  so. 
right?  Thank  goodness  for  all  those  other  peo¬ 
ple  across  the  country  who  immediately  re¬ 
wrote  the  text  editor  so  that  w  e  normal  people 
(who  make  errors)  have  some  other  choices 
besides  Ed.  editors  that  tell  you  politely  when 
they  are  working,  that  tell  you  if  they  are  in 
append  or  command  mode,  and  that  don't  let 
you  quit  without  saving  your  file  unless  you 
are  first  warned,  and  then  only  if  you  say  you 
really  mean  it. 

As  I  wrote  this  paper  I  sent  out  a 
message  on  our  networked  message  system 
and  asked  my  colleagues  to  tell  me  of  their 
favorite  peeves.  I  got  a  lot  of  responses,  but 
there  is  no  need  to  go  into  detail  about  them: 
they  all  have  much  the  same  flavor,  mostly 
commenting  about  the  lack  of  consistency 
and  the  lack  of  interactive  feedback  Thus, 
there  is  no  standardization  of  means  to  exit 
programs  (and  because  the  "shell"  is  just 
another  program  as  far  as  the  system  is  con¬ 
cerned,  it  is  very  easy  to  log  yourself  off  the 
system  by  accident).  There  are  very  useful 
pattern  matching  features  (such  as  the  "glob' ' 
function),  but  the  shell  and  the  different 
programs  use  the  symbols  in  inconsistent 
ways.  The  Unix  copy  command  (cp)  and  the 
related  C  programming  language  "string- 
copy"  (strepy)  reverse  the  meaning  of  their 
arguments,  and  Unix  move  (mv)  and  copy 
(cp)  operations  will  destroy  existing  files 
without  any  warning.  Many  programs  take 
special  "argument  flags"  but  the  manner  of 
specifying  the  flags  is  inconsistent,  varying 
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Ed’s  major  property  is  his  shyness;  he  doesn’t 
like  to  talk. 


ANOTHER  VIEW 

Prof.  Norman  praises  the  Unix  system  de¬ 
sign  but  makes  a  number  of  caustic  remarks 
about  command  names  and  other  aspects  of 
the  human  interface.  These  might  be  ig¬ 
nored.  since  he  has  no  experimental  tests  to 
justify  them;  or  they  might  even  be  taken  as 
flattery  of  UNIX,  since  he  does  not  name  any 
system  he  likes  better;  but  some  of  his 
comments  are  worth  discussing. 

Most  of  the  command  names  Nor¬ 
man  points  to  are  indeed  strange;  some, 
such  as  dsw,  were  removed  several  years 
ago  (by  the  way.  to  repair  the  discourtesy  of 
the  manual,  dsw  meant  “delete  from 
switches").  However,  it  is  not  clear  that  it 
makes  much  difference  what  the  command 
names  are.  T.  K.  Landauer.  K.  Galolti.  and 
S.  Hartwell  recently  tried  teaching  people  a 
version  of  the  editor  in  which  "append." 
"delete."  and  "substitute"  were  called 
"allege."  “cypher,"  and  "deliberate."  It 
didn't  seem  to  have  much  effect  on  learning 
time,  and  afterwards  the  users  would  say 
things  like  "I  alleged  three  lines  and  delib¬ 
erated  a  comma  on  the  last  one"  just  like 
subjects  who  had  learned  the  ordinary  ver¬ 
sion  of  the  editor  ("A  Computer  Command 
By  Any  Other  Name.  A  Study  of  Text  Edit¬ 
ing  Terms,"  available  from  the  authors  at 
Bell  Labs.) 

In  addition  to  the  amusing  but  sec¬ 
ondary  discussion  of  command  names. 
Prof.  Norman  does  raise  some  significant 
issues:  ( I )  whether  systems  should  be  ver¬ 
bose  or  terse;  ( 2)  whether  they  should  have  a 
few  general  commands  or  many  special- 
purpose  ones;  and  (3)  whether  they  should 
try  to  anticipate  typical  mistakes.  Experi¬ 
mental  results  on  these  issues  would  be  wel¬ 
come;  meanwhile,  the  armchair  evidence  is 
not  all  on  one  side. 

Unix  is  undoubtedly  near  an  extreme 
of  terseness,  partly  because  it  was  originally 
designed  for  slow  hardcopy  terminals. 
However,  the  terseness  is  very  valuable 
when  connecting  processes.  If  the  com¬ 
mand  that  lists  the  logged-on  users  prinks  a 


heading  above  the  list,  you  can't  tell  how 
many  users  are  on  by  feeding  the  command 
output  to  a  line  counter.  If  the  editor  types 
acknowledgments  now  and  then,  its  output 
may  not  be  directly  usable  as  input  some¬ 
where  else.  Of  course,  you  could  feed  it 
through  something  which  strips  off  the  extra 
remarks,  but  presumably  that  program 
would  add  its  own  chatty  messages. 

Prol.  Norman  complains  about  us¬ 
ing  "cat"  foracommand  which  prints  files, 
rather  than  having  a  special-purpose  com¬ 
mand  for  the  purpose  (there  is  one,  by  the 
way:  "pg").  Having  a  few  general-purpose 
commands  is  a  definite  aid  to  system  learn¬ 
ing  .  In  practice .  it  is  not  the  novices  who  use 
the  alternatives  to  "cat";  it  is  the  experts, 
who  want  something  better  adapted  to  their 
special  needs  and  are  willing  to  leam  anoth¬ 
er  command.  In  general,  people  are  quite 
good  at  recognizing  special  uses  of  com¬ 
mands  in  context,  probably  because  it  is  a 
lot  like  things  they  have  to  do  every  day  in 
English.  To  take  an  analogy  from  program¬ 
ming  languages,  one  doubts  that  Prof.  Nor¬ 
man  would  advocate  a  separate  operator  for 
“  +  "  in  integer  arithmetic  and  "  +  "  in 
floating  point  arithmetic.  There  are  many 
advantages  to  a  small,  general-purpose  set 
of  commands.  Having  only  one  way  to  do 
any  given  task  minimizes  software  mainte¬ 
nance  while  maximizing  the  ability  of  two 
users  to  help  each  other  with  advice.  But 
this  implies  that  whenever  a  general  com¬ 
mand  and  a  specific  command  do  the  same 
thing,  the  specific  command  should  be  re¬ 
moved.  It  would  be  a  definite  service  if  the 
"cognitive  engineers"  could  tell  us  how 
many  commands  are  reasonable,  to  give 
some  guidance  on,  for  example,  whether 
“merge"  should  be  a  separate  command  or 
an  option  on  "sort"  (on  Unix  it  is  a  sort 
option)  and  whether  the  terminal  drivers 
should  be  separate  commands  or  options  on 
a  graphics  output  command  (on  UNIX  they 
are  separate).  The  best  rule  of  thumb  we 
have  today  is  that  designing  the  system  so 


that  the  manual  will  be  as  short  as  possible 
minimizes  learning  effort. 

Prof.  Norman  seems  to  think  that  the 
computer  should  try  to  anticipate  user  prob¬ 
lems,  and  refuse  commands  that  appear 
dangerous.  The  computer  world  is  undoubt¬ 
edly  moving  in  this  direction;  strong  typing 
in  programming  languages  is  a  good  exam¬ 
ple.  The  "ed"  editor  has  warned  for  some 
years  if  the  user  tries  to  quit  without  writing 
a  file.  The  "vi"  editor  has  an  “undo"  fea¬ 
ture,  regardless  of  the  complexity  of  the 
command  which  has  been  executed.  Such  a 
facility  is  undoubtedly  the  best  solution.  It 
lets  the  user  recognize  his  mistakes  and  back 
out  of  them,  rather  than  expecting  the  sys¬ 
tem  to  foresee  them.  It  is  really  not  possible 
to  anticipate  the  infinite  variety  of  possible 
user  mistakes;  as  every  programmer  who 
has  ever  debugged  anything  knows,  it  is 
hard  enough  to  deal  with  the  correct  inputs 
to  a  program.  Human  hindsight  is  undoubt¬ 
edly  better  than  machine  foresight. 

A  large  number  of  Prof.  Norman's 
comments  are  pleas  for  consistency.  UNIX 
has  grown  more  than  it  has  been  built,  with 
many  people  from  many  places  tossing  soft¬ 
ware  into  the  system.  The  ability  of  the 
system  to  accept  commands  so  easily  is  one 
of  its  main  strengths.  However,  it  results  in 
command  names  like  “finger"  for  what 
Bell  Labs  called  “whois"  (identify  a  user) 
and  "more,"  "cat,"  or  "pg"  for  what 
Prof.  Norman  would  rather  call  "list."  The 
thought  of  a  UNIX  Command  Standardiza¬ 
tion  Committee  trying  to  impose  rules  on 
names  is  a  frightening  alternative.  Much  of 
the  attractiveness  of  UNIX  derives  from  its 
hospitality  to  new  commands  and  features. 
This  has  also  meant  a  diversity  ot  names  and 
styles.  To  some  of  us  tf’.s  diversity  is  • 
live,  while  to  other.*  'It-jt'/ersity  is  frustrat¬ 
ing.  but  to  hope  for  tfle  hospitality  without 
the  diversity  is  unrealistic. 

— Michael  Lack 
Ball  Labs 
Murray  Hill,  NJ. 


from  program  to  program.  ground  to  foreground  (and  vice  versa),  exam-  difficulties. 

The  version  of  UNIX  I  now  use  is  ine  files,  and  then  resume  jobs.  The  shell  has  To  work  on  this  paper.  I  need  only 

called  the  Fourth  Berkeley  Edition  for  the  been  amplified  to  be  a  more  powerful  pro-  type  the  word  “unix."  for  I  have  set  up  an 

vax.  distributed  by  Joy.  Babaoglu.  Fabry,  gramming  language,  complete  with  file  han-  alias  called  "unix"  that  is  defined  lobe  equal 

and  Sklower  at  the  University  of  California,  dling  capabilities,  if— then — else  statements,  to  the  correct  command  to  change  directories. 

Berkeley  (henceforth,  Berkeley  UNIX).  This  while,  case,  and  other  goodies  of  structured  combined  with  a  call  to  the  editor  (called 

is  both  good  and  bad.  programming  (see  box.  p.  00).  "vi"  for"visual"onthissystem)onthefile: 

Among  the  advantages;  History  lists.  Aliases  are  worthy  of  special  com-  alias  unix  "chdir /csl /norman/papers/ 

aliases,  a  richer  and  more  intelligent  set  of  menu  Aliases  let  users  tailor  the  system  to  CogEngineering:  vi  unix" 

system  programs  ( including  a  list  program,  an  their  own  needs,  naming  things  in  ways  they  These  Berkeley  UNIX  features  have  proven  to 

intelligent  screen  editor,  an  intelligent  set  of  can  remember;  names  you  devise  yourself  are  be  indispensable:  the  people  in  my  laboratory 

routines  for  interacting  with  terminals  accord-  easier  to  recall  than  names  provided  to  you.  would  probably  refuse  to  go  back  to  standard 

ingtolheircapabililies),andajobcontrolthat  And  aliases  allow  abbreviations  that  are  UNIX 

allows  one  to  stop  jobs  right  in  the  middle,  meaningful  to  the  individual,  without  burden-  The  bad  news  is  that  Berkeley  UNIX  is 

start  up  new  ones,  move  things  from  back-  ing  everyone  else  with  your  cleverness  or  jury-rigged  on  top  of  regular  UNIX,  so  it  can 
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There  are  lots  of  aids  to  memory  that  can  be 
provided,  but  the  most  powerful  of  all  is  understanding. 


only  patch  up  the  faults:  it  can't  remedy  them. 
Grep  is  not  only  still  grep.  but  there  is  an 
egrep  and  an  fgrep. 

And  the  generators  of  Berkeley  UNIX 
have  their  problems:  if  Bell  Labs  people  are 
smug  and  lean.  Berkeley  people  are  cute  and 
overweight.  Programs  are  wordy.  Special 
features  proliferate.  The  system  is  now  so 
large  that  it  no  longer  fits  on  the  smaller 
machines:  our  laboratory  machine,  a  dec  1 1 
45.  cannot  hold  the  latest  release  of  Berkeley 
Unix  (even  with  a  full  complement  of  mem¬ 
ory  and  a  reasonable  amount  of  disk).  I  wrote 
this  paper  on  a  vax. 

LEARNING  Naming  the  system  for 

IS  NOT  setting  up  aliases  is  not 

r>«u  easy  for  beginners,  who 

may  be  the  people  who 
need  them  most  You  have  to  set  them  up  in  a 
file  called  cshrc.  not  a  name  that  inspires 
confidence.  The  "period"  in  the  filename 
means  that  it  is  invisible — the  normal  method 
of  directory  listing  programs  won't  show  it. 
The  directory  listing  program.  Is.  comes  with 
19  possible  argument  flags,  which  can  be 
used  singly  or  in  combinations  The  number 
of  special  files  that  must  be  set  up  to  use  all  the 
facilities  is  horrendous,  and  they  get  more 
complex  with  each  new  release  from  Berke 
ley. 

It  is  very  difficult  for  new  users.  The 
program  names  are  cute  rather  than  systemat¬ 
ic.  Cuteness  is  probably  better  than  standard 
UNIX's  lack  of  meaning,  but  there  are  limits. 
The  listing  program  is  called  "more"  (as  in. 
“give  me  more"),  the  program  that  tells  you 
who  is  on  the  system  is  called  “finger,"  and  a 
keyword  help  file — most  helpful,  by  the 
way — is  called  “apropos."  I  used  the  alias 
feature  to  rename  it  "help." 

One  reader  of  a  draft  of  this  paper — a 
systems  programmer — complained  bitterly: 
“Such  whining,  hand-wringing,  and  general 
bitchiness  will  cause  most  people  to  dismiss  it 
as  over-emotional  nonsense  .  .  .  The  UNIX 
system  was  originally  designed  by  systems 
programmers  for  their  own  use  and  with  no 
intention  for  others  using  it.  Other  hackers 
liked  it  so  much  that  eventually  a  lot  of  them 
started  using  it.  Word  spread  about  this  won¬ 
derful  system,  and  the  rest  you  probably 
know.  I  think  that  Ken  Thompson  and  Dennis 
Ritchie  could  easily  shrug  their  shoulders  and 
say  ‘But  we  never  intended  it  for  other  than 
our  personal  use.'  " 

This  complaint  was  unique,  and  I 
sympathize  with  its  spirit.  It  should  be  re¬ 
membered,  though,  that  UNIX  is  nationally 
distributed  under  strict  licensing  agreements. 
Western  Electric's  motives  are  not  altogether 
altruistic.  If  Unix  had  remained  a  simple  ex¬ 
periment  on  the  development  of  operating 
systems,  then  complaints  could  be  made  in  a 
more  friendly,  constructive  manner.  But  UNIX 


is  more  than  that .  It  is  taken  as  the  very  model 
of  a  proper  operating  system.  And  that  is 
exactly  what  it  is  not. 

In  the  development  of  the  system  as¬ 
pects  of  UNIX,  the  designers  have  done  a  mag¬ 
nificent  job.  They  have  been  creative,  and 
systematic.  A  common  theme  runs  through 
the  development  of  programs,  and  by  means 
of  their  file  structure,  the  development  of 
"pipes"  and  "redirection"  of  both  input  and 
output,  plus  the  power  of  the  iterative  "shell" 
system-level  commands,  one  can  easily  com¬ 
bine  system  level  programs  into  self-tailored 
systems  of  remarkable  power.  For  system 
programmers,  UNIX  is  a  delight.  It  is  well 
structured,  with  a  consistent,  powerful  phi¬ 
losophy  of  control  and  structure. 

Why  was  the  same  effort  not  put  into 
the  design  at  the  level  of  the  user?  The  answer 
is  complex,  but  one  reason  is  the  fact  that 
there  really  are  no  well  known  principles  of 
design  at  the  level  of  the  user  interface.  So,  to 
remedy  the  harm  I  may  have  caused  with  my 
heavy-handed  sarcasm,  let  me  attempt  to  pro¬ 
vide  some  positive  suggestions  based  upon 
research  conducted  by  myself  and  others  into 
the  principles  of  the  human  information  pro¬ 
cessing  system. 

Cognitive  engineering  is  a  new  disci¬ 
pline.  so  new  that  it  doesn't  exist,  but  it  ought 
to  Quite  a  bit  is  known  about  the  human 
information  processing  system,  enough  that 
we  can  specify  some  basic  principles  for  de¬ 
signers.  People  are  complex  entities  and  can 
adapt  to  almost  anything.  As  a  result,  design¬ 
ers  often  design  for  themselves,  without  re¬ 
gard  for  other  kind  -  f  users. 

The  three  mosi  important  concepts  for 
system  design  are  these: 

1.  Be  consistent.  A  fundamental  set 
of  principles  ought  to  be  evolved  and  fol¬ 
lowed  consistently  throughout  all  phases  of 
the  design. 

2.  Provide  the  user  with  an  explicit 
model.  Users  develop  mental  models  of  the 
devices  with  which  they  interact.  If  you  do 
not  provide  them  with  one,  they  will  make 
one  up  themselves,  and  the  one  they  create  is 
apt  to  be  wrong. 

Do  not  count  on  the  user  fully  under¬ 
standing  the  mechanics  of  the  device.  Both 
secretaries  and  scientists  may  be  ignorant  of 
the  difference  between  the  buffer,  the  work¬ 
ing  memory,  the  working  files,  and  the  per¬ 
manent  files  of  a  text  editor.  They  are  apt  to 
believe  that  once  they  have  typed  something 
into  the  system,  it  is  permanently  in  their 
files.  They  are  apt  to  expect  more  intelligence 
from  the  system  than  the  designer  knows  is 
there.  And  they  are  apt  to  read  into  comments 
(or  the  lack  of  comments)  more  than  you  have 
intended. 

Feedback  is  of  critical  importance  in 
helping  establish  the  appropriate  mental  mod¬ 
el  and  in  letting  the  user  keep  its  current  state 


in  synchrony  with  the  actual  system 

3.  Provide  mnemonic  aids.  For  most 
purposes  it  is  convenient  to  think  of  human 
memory  as  consisting  of  two  parts:  a  short¬ 
term  memory  and  a  long-term  memory  ( mod¬ 
em  cognitive  psychology  is  developing  more 
sophisticated  notions,  but  this  is  still  a  valid 
approximation).  Five  to  seven  items  is  about 
the  limit  for  short-term  memory.  Thus,  do  not 
expect  a  user  to  remember  the  contents  of  a 
message  for  much  longer  than  it  is  visible  on 
the  terminal.  Long-term  memory  is  robust, 
but  it  faces  two  difficulties:  getting  stuff  in  so 
that  it  is  properly  organized,  and  getting  stuff 
out  when  it  is  needed.  Learning  is  difficult, 
unless  there  is  a  good  structure  and  it  is  visible 
to  the  learner. 

There  are  lots  of  sensible  memory  aids 
that  can  be  provided,  but  the  most  powerful 
and  sensible  of  all  is  understanding.  Make  the 
command  names  describe  the  function  that  is 
desired.  If  abbreviations  must  be  used,  adopt 
a  consistent  policy  of  forming  them.  Do  not 
deviate  from  the  policy,  even  when  it  appears 
that  a  particular  command  warrants  doing  so. 

System  designers  take  note.  Design 
the  system  for  the  person,  not  for  the  comput¬ 
er,  not  even  for  yourself.  People  are  also 
information  processing  systems,  with  varying 
degrees  of  knowledge  and  experience. 
Friendly  systems  treat  users  as  normal,  intel¬ 
ligent  adults  who  are  sometimes  forgetful  and 
are  rarely  as  knowledgeable  about  the  world 
as  they  would  like  to  be.  There  is  no  need  to 
talk  down  to  the  user,  nor  to  explain  every¬ 
thing.  But  give  the  users  a  share  in  under¬ 
standing  by  presenting  a  consistent  view  of 
the  system.  Their  response  will  be  your  re¬ 
ward.  # 
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THE  TROUBLE 
WITH  NETWORKS 

Computer  networks  are  in  everyone's  future,  the  prophets  tell  us, 
and  will  bring  about  new  styles  of  communication.  How  will  the 
changes  affect  us?  The  following,  a  personal  case  study  in  the 
sociology  of  computer  networks,  may  provide  a  few  clues. 

One  weekend,  when  1  should  have  been  doing  something 
else,  and  when  1  had  once  more  made  a  minor  error  while  working  at 
my  computer  terminal.  1  collected  my  frustrations  together  into  the 
paper  “The  Trouble  with  UNIX"  (November,  p.  139).  Little  did  1 
know  that  1  was  thereby  setting  into  motion  a  chain  of  events  that 
would  occupy  me  for  many  months.  A  draft  of  my  article  was 
circulated  on  a  national  computer  network,  and  soon  brought  me 
fame  and  insult. 

My  computer  is  part  of  a  hardwired  campus  network  of 
computers  that  use  the  UNIX  operating  system.  This  local  campus 
network  is,  in  turn,  part  of  a  statewide  telephone  UNIX  network  that 
interconnects  many  campuses  of  the  University  of  California.  The 
campus  network  is  connected  to  a  nationwide  dial-up  network  of 
UNIX  users,  which  was  started,  I  believe,  by  people  at  various  Bell 
Laboratories  in  New  Jersey  and  elsewhere.  The  campus  network  is 
also  connected  to  the  Defense  Department's  packet-switching  net¬ 
work  (Arpanet).  In  addition  to  distributing  messages,  manu¬ 
scripts,  programs,  and  documentation,  the  net  also  provides  a  num¬ 
ber  of  "bulletin  boards.”  These  are  collections  of  messages  con¬ 
structed  so  that  people  who  are  interested  in  related  topics  can  hold 
discussions,  ask  specialized  questions  of  one  another,  and  pass  on 
information  thought  to  be  of  general  interest,  ,. 

One  day,  someone  logged  onto  my  computer,  found  the  file 
in  which  the  paper  was  located,  and  distributed  it  through  the 
network  bulletin  board  called  “UNIX- wizards. "  From  there  it  was 
distributed  over  at  least  one  other  bulletin  board,  and  probably  over 
many  individual  messages  and  to  many  different  locations.  Thus, 
the  paper  was  sent  all  over  the  country ,  to  large  numbers  of  sites  and 
possibly  thousands  of  readers.  This  was  done  without  my  knowl¬ 
edge  (and  therefore,  without  my  permission,  although  I  would  have 
granted  permission  had  I  been  asked).  In  addition,  the  culprit 
managed  to  disguise  the  transmission  so  that  the  source  could  not  be 
identified. 

How  did  that  happen?  Well,  we  run  an  open  computer 
facility,  and  users  are  allowed  to  look  over  other  people's  files.  We 
can  and  do  protect  confidential  material.  The  rule  is  that  people  may 
look  freely,  and  if  users  wish  some  things  to  be  private,  they  must 
protect  the  access  to  those  files.  The  location  of  my  paper  was  well 
known  because  1  had  asked  people  to  read  it  and  give  me  feedback. 
The  thief  was  probably  someone  authorized  to  use  our  machine,  and 
probably  an  expert  systems  person  who  had  the  knowledge  and 
authorization  to  disguise  the  source  of  the  transmission. 


The  first  news  I  had  that  my  paper  had  been  distributed  was 
when  a  local  systems  programmer  sent  me  a  copy  of  a  message  he 
was  sending  in  response  to  someone  at  Bell  Labs,  agreeing  with  the 
Bell  Labs  person  that  my  article  was  appalling.  The  only  part  of  the 
original  message  from  Bell  Labs  that  1  was  allowed  to  see  said, 
“Who  is  Don  Norman  and  why  is  he  saying  those  terrible  things 
about  me?" 

From  that  point  on,  things  got  hectic.  A  flurry  of  comments 
appeared  on  several  of  the  bulletin  boards.  The  article  was  a  disas¬ 
ter,  said  one.  Another  person  agreed  with  many  of  the  observations, 
but  thought  “the  paper  should  not  be  a  criticism  of  UNIX  itself,  but 
rather  a  criticism  of  how  people  use  UNIX. "  Some  people  said  the 
piece  was  correct.  Others  claimed  it  was  all  wrong,  and  that  anyone 
who  had  problems  with  Unix  didn't  deserve  to  be  using  it  in  the  first 
place.  Eventually,  people  discovered  my  proper  network  address 
and  began  sending  mail  directly  to  me,  bypassing  the  bulletin 
boards.  I  was  flooded  with  comments.  “Datamation  readers  are 
typically  IBM  users,"  said  one  note,  “and  they  will  now  say  ‘You 
see?  Unix  is  poorly  designed,  this  psychologist  says  so.  Wake  me  up 
when  you  have  an  operating  system  better  than  IBM’s.'  ...  1  hope 
that  both  of  you  live  happily  ever  after.”  From  Texas,  Utah, 
Toronto,  from  the  various  Bell  Labs,  from  California,  from  Massa¬ 
chusetts — the  notes  kept  coming.  Soon  I  was  spending  over  an  hour 
each  morning  just  reading  the  previous  day’s  accumulation  and 
answering  them.  When  I  printed  out  all  the  messages  that  I  had 
received  on  a  hardcopy  terminal,  it  took  32  single-spaced  pages. 

The  majority  of  these  comments  were  laudatory.  Several 
people  wanted  advice  on  systems  they  were  working  on.  I  had 
useful  interchanges  with  them  and,  in  the  process,  clarified  my  own 
understanding  of  the  issues.  A  manager  of  a  major  system — call  it 
System  X — gave  me  a  computer  account  on  X  (and  promised  to 
send  the  manuals),  asking  me  to  do  a  similar  analysis  on  it  so  that  his 
team  could  improve  it.  He  did  lay  down  the  restriction  that  I  not 
write  a  new  article  called  ‘The  Truth  About  System  X. "  Although 
we  are  not  yet  finished  with  our  analysis  (the  manuals  haven't 
arrived  yet),  interaction  like  this  is  quite  gratifying — the  kind  of 
thing  one  hopes  for. 

The  most  positive  interactions,  however,  took  place  with 
people  at  Bell  Laboratories — people  who  had  been  on  the  receiving 
end  of  my  criticisms.  After  a  somewhat  hesitant  start,  our  dialog 
became  quite  useful.  We  have  discussed  a  number  of  issues  and 
agreed  upon  some  points  that  need  further  treatment.  I  sent  them  the 
box  describing  Unix  that  was  published  alongside  my  article,  and 
they  rewrote  it  to  clarify  points  and  correct  errors.  They  sent  me  the 
rebuttal  they  were  writing,  and  I  thought  it  a  good  one  (it  too  was 
published  alongside  my  article).  I  sent  them  several  papers  that  1 
was  working  on  and  they  sent  me  reprints  of  their  published  papers 
on  unix.  One  of  our  current  graduate  students  sent  descriptions  of 
the  menu-driven  command  interpreter  for  the  UNIX  shell  that  he  was 
developing,  and  so  on.  These  interchanges  have  helped  clarify 
issues  on  all  sides,  eventually  leading  all  of  us  to  a  better  under¬ 
standing  of  the  constraints  on  system  design  and  release,  and  to  an 
awareness  of  the  needs  and  limitations  of  a  wide  variety  of  users. 


(CONTINUED  NEXT  PAGE) 


The  weaknesses  and  the  strengths  of  computer  networking 
derive  from  the  same  feature:  it  is  easy  to  send  messages  to  anyone 
who  has  access  to  the  network.  Because  a  new  message  is  so  easily 
generated,  it  can  be  composed  immediately  upon  the  receipt  of  one 
that  has  aroused  the  emotions.  But  if  a  message  is  composed  in  the 
heat  of  passion,  the  passion  may  distort  it,  so  that  the  result  is  not 
always  as  effective  as  one  might  hope. 

The  ease  with  which  people  can  generate  additions  to  the 
bulletin  board  and  messages  to  others  has  another  major  drawback: 
electronic  junk  mail.  Many  of  my  colleagues  and  l  have  stopped 
reading  the  network  news  and  bulletin  boards  because  we  cannot 
afford  the  time  to  do  so  every  day.  (I  did  not  know  my  paper  had 
been  distributed  and  would  not  have  discovered  the  flurry  it  created 
had  others  not  alerted  me  to  it.)  This  will  be  less  of  a  problem  when 
we  have  intelligent  programs  that  can  aid  in  browsing  through  tables 
of  contents,  perhaps  with  intelligent  keyword  or  content  specified 
searches  to  winnow  through  the  accumulation.  Perhaps  we  can  put 
together  some  quasi-inteliigent  text-understanding  systems  that  can 
help  sort  through  the  material.  However,  until  something  is  done  to 
improve  the  organization,  the  very  success  of  these  message  sys¬ 
tems  and  bulletin  boards  will  threaten  their  usefulness. 

Another  interesting  social  phenomenon  that  may  occur 
within  an  organization  possessing  an  effective  computer  mail  sys¬ 
tem  is  that  people  will  tend  to  use  it  in  preference  to  talking. 
Computer  mail  is  much  more  efficient  than  telephone  calls  or  visits 
because  you  can  generate  it  whenever  you  wish  without  concern  for 
whether  the  recipient  is  in.  Similarly,  the  recipient  can  read  and 
answer  messages  at  leisure.  It  is  better  than  postal  mail  or  interof¬ 
fice  memos  because  it  is  easier,  less  formal,  and  can  be  almost 
instantaneous  if  the  recipient  wishes  it  to  be.  In  our  laboratory,  this 
sometimes  leads  to  strange  behavior.  It  is  not  unheard  of  for  one 
person  to  see  another  in  the  hall  and  to  say  '  T  am  going  to  send  you 
a  message,"  and  then  go  do  so,  forgetting  that  the  information 
could  simply  have  been  spoken. 

The  positive  side  of  these  networks  overcomes  the  negative. 
People  can  communicate  their  ideas  to  others  across  the  country, 
quickly  and  effectively.  In  turn,  the  recipients  can  respond,  criticiz¬ 
ing,  sharing,  and  improving  the  product.  The  network  communica¬ 
tions  keep  me  informed  on  a  variety  of  issues  from  substantive 
research  topics  to  trip  and  conference  schedules.  I  can  count  on  my 
colleagues  who  do  read  the  bulletin  boards  to  alert  me  to  relevant 
articles,  just  as  I  pass  on  the  interesting  messages  that  I  receive. 
Small  communities  of  people  with  shared  concerns  can  quickly  be 
formed  to  hold  constructive  discussion  about  an  issue.  The  inter¬ 
changes  can  be  quite  effective,  in  pan  because  of  the  rapidity  with 
which  messages  are  generated  and  sent:  it  only  takes  a  few  hours  for 
a  comment  to  spread  out  over  the  community. 

The  unauthorized  distribution  of  my  paper  has  been  a  useful 
sociological  experience — a  true  test  case  of  what  will  indeed  be  in 
all  our  futures:  interactive  journals,  computer  bulletin  boards,  and 
readily  available  computer  message  systems. 

—Donald  A.  Norman 
La  Mia,  CaNfoniia 
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